[Federal Register Volume 88, Number 203 (Monday, October 23, 2023)]
[Proposed Rules]
[Pages 72701-72723]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-23449]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF THE TREASURY
Financial Crimes Enforcement Network
31 CFR Part 1010
RIN 1506-AB64
Proposal of Special Measure Regarding Convertible Virtual
Currency Mixing, as a Class of Transactions of Primary Money Laundering
Concern
AGENCY: Financial Crimes Enforcement Network (FinCEN), Treasury.
ACTION: Notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: FinCEN is issuing a notice of proposed rulemaking (NPRM),
pursuant to section 311 of the USA PATRIOT Act, that proposes requiring
domestic financial institutions and domestic financial agencies to
implement certain recordkeeping and reporting requirements relating to
transactions involving convertible virtual currency (CVC) mixing.
DATES: Written comments on the notice of proposed rulemaking must be
submitted on or before January 22, 2024.
ADDRESSES: Comments must be submitted by one of the following methods:
Federal E-rulemaking Portal: https://www.regulations.gov.
Follow the instructions for submitting comments. Refer to Docket Number
FINCEN-2023-0016 in the submission.
Mail: Financial Crimes Enforcement Network, P.O. Box 39,
Vienna, VA 22183. Refer to Docket Number FINCEN-2023-0016 in the
submission.
Please submit comments by one method only, and note that comments
submitted in responses to this NPRM will become a matter of public
record.
FOR FURTHER INFORMATION CONTACT: The FinCEN Regulatory Support Section
at 1-800-767-2825 or electronically at [email protected].
SUPPLEMENTARY INFORMATION:
I. Statutory Provisions
Section 311 of the USA PATRIOT Act (section 311), codified at 31
U.S.C. 5318A, grants the Secretary of the Treasury (Secretary)
authority, upon finding that reasonable grounds exist for concluding
that one or more classes of transactions within or involving a
jurisdiction outside of the United States is of primary money
laundering concern, to require domestic financial institutions and
domestic financial agencies to take certain ``special measures.'' \1\
The authority of the Secretary to administer section 311 and the Bank
Secrecy Act (BSA) has been delegated to FinCEN.\2\
---------------------------------------------------------------------------
\1\ On October 26, 2001, the President signed into law the
Uniting and Strengthening America by Providing Appropriate Tools
Required to Intercept and Obstruct Terrorism Act of 2001, Public Law
107-56 (USA PATRIOT Act). Title III of the USA PATRIOT Act amended
the anti-money laundering (AML) provisions of the Bank Secrecy Act
(BSA) to promote the prevention, detection, and prosecution of
international money laundering and the financing of terrorism. The
BSA, as amended, is the popular name for a collection of statutory
authorities that FinCEN administers that is codified at 12 U.S.C.
1829b, 1951-1960 and 31 U.S.C. 5311-5314, 5316-5336, and includes
other authorities reflected in notes thereto. Regulations
implementing the BSA appear at 31 CFR Chapter X.
\2\ Pursuant to Treasury Order 180-01 (Jan. 14, 2020), the
authority of the Secretary to administer the BSA, including, but not
limited to, 31 U.S.C. 5318A, has been delegated to the Director of
FinCEN.
---------------------------------------------------------------------------
The five special measures set out in section 311 are prophylactic
safeguards that may be employed to defend the United States financial
system from money laundering and terrorist financing risks. The
Secretary may impose one or more of these special measures in order to
protect the U.S. financial system from such threats. Through special
measure one, the Secretary may require domestic financial institutions
and domestic financial agencies to maintain records, file reports, or
both, concerning the aggregate amount of transactions or individual
transactions.\3\ Through special measures two through four, the
Secretary may impose additional recordkeeping, information collection,
and reporting requirements on covered domestic financial institutions
and domestic financial agencies.\4\ Through special measure five, the
Secretary may prohibit, or impose conditions upon, the opening or
maintaining in the United States of correspondent or payable-through
accounts for or on behalf of a foreign banking institution, if the
class of transactions found to be of primary money laundering concern
may be conducted through such correspondent account or payable-through
account.\5\
---------------------------------------------------------------------------
\3\ 31 U.S.C. 5318A(b)(1).
\4\ 31 U.S.C. 5318A(b)(2)-(b)(4).
\5\ 31 U.S.C. 5318A(b)(5).
---------------------------------------------------------------------------
Before making a finding that reasonable grounds exist for
concluding that a class of transactions is of primary money laundering
concern, the Secretary is required to consult with both the Secretary
of State and the Attorney General.\6\ The Secretary is also required to
consider such information as the Secretary determines to be relevant,
including the following potentially relevant factors:
---------------------------------------------------------------------------
\6\ 31 U.S.C. 5318A(c)(1).
---------------------------------------------------------------------------
The extent to which such class of transactions is used to
facilitate or promote money laundering in or through a jurisdiction
outside the United States, including any money laundering activity by
organized criminal groups, international terrorists, or entities
involved in the proliferation of weapons of mass destruction (WMD) or
missiles;
The extent to which such class of transactions is used for
legitimate business purposes in the jurisdiction; and
The extent to which such action is sufficient to ensure
that the purposes of section 311 are fulfilled and to guard against
international money laundering and other financial crimes.\7\
---------------------------------------------------------------------------
\7\ 31 U.S.C. 5318A(c)(2)(B).
---------------------------------------------------------------------------
Upon finding that a class of transactions is of primary money
laundering concern, the Secretary may require covered financial
institutions to take one or more special measures. In selecting one or
more special measures, the Secretary ``shall consult with the Chairman
of the Board of Governors of the Federal Reserve System, any other
appropriate Federal banking agency (as defined in section 3 of the
Federal Deposit Insurance Act), the Secretary of State, the Securities
and Exchange Commission, the Commodity Futures Trading Commission, the
National Credit Union Administration Board, and in the sole discretion
of the Secretary, such other agencies and interested parties as the
Secretary may find appropriate.'' \8\
---------------------------------------------------------------------------
\8\ 31 U.S.C. 5318A(a)(4)(A).
---------------------------------------------------------------------------
In addition, the Secretary is required to consider the following
factors when selecting special measures:
Whether similar action has been or is being taken by other
nations or multilateral groups;
Whether the imposition of any particular special measure
would create a significant competitive disadvantage, including any
undue cost or burden associated with compliance, for financial
institutions organized or licensed in the United States;
The extent to which the action or the timing of the action
would have a significant adverse systemic impact on the international
payment, clearance, and settlement system, or on legitimate
[[Page 72702]]
business activities involving the particular jurisdiction, institution,
class of transactions, or type of account; and
The effect of the action on United States national
security and foreign policy.\9\
---------------------------------------------------------------------------
\9\ 31 U.S.C. 5318A(a)(4)(B).
---------------------------------------------------------------------------
II. Summary of NPRM
Convertible Virtual Currency (CVC) mixing entails the facilitation
of CVC \10\ transactions in a manner that obfuscates the source,
destination, or amount involved in one or more transactions.\11\
Because CVC mixing is intended to make CVC transactions untraceable and
anonymous, CVC mixing is ripe for abuse by, and frequently used by,
illicit foreign actors that threaten the national security of the
United States and the U.S. financial system. By obscuring the
connection between the CVC wallet addresses used to receive illicit CVC
proceeds and the CVC wallet addresses from which illicit CVC is
transferred to CVC-to-fiat \12\ currency exchangers, other CVC users,
or CVC exchanges, CVC mixing transactions can play a central role in
facilitating the laundering of CVC derived from a variety of illicit
activity.
---------------------------------------------------------------------------
\10\ For the purposes of this NPRM, the term ``CVC'' is defined
as a medium of exchange that either has an equivalent value as
currency or acts as a substitute for currency, but lacks legal
tender status. Although Bitcoin has legal tender status in at least
two jurisdictions, the term ``CVC'' includes Bitcoin.
\11\ A more detailed definition of this term is provided in
Section IX of this NPRM.
\12\ Fiat currency refers to traditional currency such as the
U.S. dollar.
---------------------------------------------------------------------------
Indeed, CVC mixing transactions are frequently used by criminals
and state actors to facilitate a range of illicit activity, including,
but not limited to, money laundering, sanctions evasion and WMD
proliferation by the Democratic People's Republic of Korea (DPRK or
North Korea), Russian-associated ransomware attacks,\13\ and illicit
darknet markets. Further, a recent assessment by FinCEN determined that
the percentage of CVC transactions processed by CVC mixers that
originated from likely illicit sources is increasing.\14\ CVC mixing
often involves foreign jurisdictions because persons who facilitate or
engage in CVC mixing transactions are often located abroad, including
notable recent CVC mixing activity involving DPRK-affiliated threat
actors, Russian ransomware actors, and buyers and sellers on Russian
darknet markets.
---------------------------------------------------------------------------
\13\ Notwithstanding the use of ``attack'' as a legal term of
art in certain settings, FinCEN here and throughout intends only the
colloquial meaning of the term.
\14\ A more detailed examination of analysis is below in Section
IV.A.3 of this NPRM.
---------------------------------------------------------------------------
Accordingly, because CVC mixing provides foreign illicit actors
with enhanced anonymity that allows them to launder their illicit
proceeds, FinCEN assesses that transactions involving CVC mixing within
or involving a jurisdiction outside the United States are of primary
money laundering concern, and, having undertaken the necessary
consultations, also finds that imposing additional recordkeeping and
reporting requirements would assist in mitigating the risks posed by
such transactions. Such reporting will assist law enforcement with
identifying the perpetrators behind illicit transactions and
preventing, investigating, and prosecuting illegal activity, as well as
rendering such transactions--through increased transparency--less
attractive and useful to illicit actors. This NPRM (1) sets forth
FinCEN's finding that transactions involving CVC mixing within or
involving jurisdictions outside the United States are a class of
transactions that are of primary money laundering concern; and (2)
proposes, under special measure one, requiring covered financial
institutions to implement certain recordkeeping and reporting
requirements on transactions that covered financial institutions know,
suspect, or have reason to suspect involve CVC mixing within or
involving jurisdictions outside the United States.
III. Background
Although the United States supports innovation and advances in
digital and distributed ledger technology for financial services, it
must also consider the substantial implications that such technology
has for national security and mitigate the attendant risks for
consumers, businesses, national security, and the integrity of the
broader U.S. financial system.\15\ CVC can be used for legitimate and
innovative purposes. However, it is not without its risks and, in
particular, the use of CVC to anonymize illicit activity undermines the
legitimate and innovative uses of CVC.
---------------------------------------------------------------------------
\15\ White House, Executive Order on Ensuring Responsible
Development of Digital Assets Fact Sheet, Mar. 9, 2022, available at
https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/09/fact-sheet-president-biden-to-sign-executive-order-on-ensuring-responsible-innovation-in-digital-assets/.
---------------------------------------------------------------------------
A. CVC Mixing and Its Mechanisms
The term ``virtual currency'' refers to a medium of exchange that
can operate like currency but does not have all the attributes of
``real,'' or fiat, currency. CVC is a type of virtual currency that
either has an equivalent value as currency or acts as a substitute for
currency and is therefore a type of ``value that substitutes for
currency.'' The label applies to any particular type of CVC, such as
``digital currency,'' ``cryptocurrency,'' ``cryptoasset,'' and
``digital asset.'' 16 17
---------------------------------------------------------------------------
\16\ See, e.g., FinCEN, FIN-2019-G001, Application of FinCEN's
Regulations to Certain Business Models Involving Convertible Virtual
Currencies, May 9, 2019, available at https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf
(FinCEN 2019 CVC Guidance).
\17\ FinCEN notes that CVC or ``virtual currency'' by itself
does not meet the definition of a ``currency'' under 31 CFR
1010.100(m). Additionally, potential characterization of CVC as
currency, securities, commodities, or derivatives for the purposes
of any other legal regime, such as the Federal securities laws or
the Commodity Exchange Act, is outside the scope of this proposed
rule. However, as described in the FinCEN 2019 CVC Guidance, if
assets that other regulatory frameworks defined as commodities,
securities, or futures contracts were to be specifically issued or
later repurposed to serve as a currency substitute, then the asset
itself could be a type of value that substitutes for currency and be
defined as CVC for the purposes of this proposed rule, in addition
to being subject to other applicable regulatory frameworks.
---------------------------------------------------------------------------
The public nature of most CVC blockchains,\18\ which provide a
permanent, recorded history of all previous transactions, make it
possible to know someone's entire financial history on the blockchain.
Anonymity enhancing tools, including ``mixers,'' are used to avoid
this. To provide enhanced anonymity, CVC mixers provide a service--CVC
mixing--that is intended to obfuscate transactional information,
allowing users to obscure their connection to the CVC.
---------------------------------------------------------------------------
\18\ Blockchain refers to a type of distributed ledger
technology (DLT) that cryptographically signs transactions that are
grouped into blocks. For more information on blockchain, see
National Institute of Science and Technology, Blockchain, available
at https://www.nist.gov/blockchain.
---------------------------------------------------------------------------
There are a number of ways to conduct CVC mixing transactions--one
of the most common of which is the use of CVC mixers. CVC mixers can
accomplish this through a variety of mechanisms, including: pooling or
aggregating CVC from multiple individuals, wallets, or accounts into a
single transaction or transactions; splitting an amount into multiple
amounts and transmitting the CVC as a series of smaller independent
transactions; or leveraging code to coordinate, manage, or manipulate
the structure of the transaction; among other methods. Through such
mechanisms, CVC mixers can functionally simulate a customer depositing
funds from an anonymous account into a financial institution's omnibus
account and withdrawing funds into a separate anonymous account.\19\
For example, a
[[Page 72703]]
criminal actor could take the illicit proceeds of their crime, send the
CVC to a CVC mixer, and then on to an account they hold at a virtual
asset service provider (VASP). At this point, the VASP would take
custody of the illicitly sourced CVC, thereby allowing illicit funds to
enter their omnibus account, all while being unaware of the origin of
the illicit CVC. The critical challenge is that CVC mixing services
rarely, if ever, provide to regulators or law enforcement the resulting
transactional chain or information collected as part of the
transaction.
---------------------------------------------------------------------------
\19\ See U.S. Department of the Treasury (Treasury), DeFi Risk
Assessment, Apr. 2023, at p. 19, available at https://home.treasury.gov/system/files/136/DeFi-Risk-Full-Review.pdf
(Treasury April 2023 Defi Risk Assessment).
---------------------------------------------------------------------------
CVC mixing does not, however, wholly rely on the use of CVC mixers.
There are certain methods that CVC users--and CVC mixers--often employ
in an effort to obfuscate their transactions. These methods include:
a. Pooling or aggregating CVC from multiple persons, wallets,
addresses, or accounts: This method involves combining CVC from two or
more persons into a single wallet or smart contract and, by pooling or
aggregating that CVC, obfuscating the identity of both parties to the
transaction by decreasing the probability of determining both intended
persons for each unique transaction.
b. Splitting CVC for transmittal and transmitting the CVC through a
series of independent transactions: This method involves splitting a
single transaction from sender to receiver into multiple, smaller
transactions, in a manner similar to structuring, to make transactions
blend in with other, unrelated transactions on the blockchain occurring
at the same time so as to not stand out, thereby decreasing the
probability of determining both intended persons for each unique
transaction.
c. Using programmatic or algorithmic code to coordinate, manage, or
manipulate the structure of a transaction: This method involves the use
of software that coordinates two or more persons' transactions together
in order to obfuscate the individual unique transactions by providing
multiple potential outputs from a coordinated input, decreasing the
probability of determining both intended persons for each unique
transaction.
d. Creating and using single-use wallets, addresses, or accounts
and sending CVC through these wallets, addresses, or accounts in a
series of transactions: This method involves the use of single-use
wallets, addresses, or accounts--colloquially known as a ``peel
chain''--in a series of unnatural transactions that have the purpose or
effect of obfuscating the source and destination of funds by
volumetrically increasing the number of involved transactions, thereby
decreasing the probability of determining both intended persons for
each unique transaction.
e. Exchanging between types of CVC, or other digital assets: This
method involves exchanges between two or more types of CVC or other
digital assets--colloquially referred to as ``chain hopping''--to
facilitate transaction obfuscation by converting one CVC into a
different CVC at least once before moving the funds to another service
or platform thereby decreasing the probability of determining both
intended persons for each unique transaction.\20\
---------------------------------------------------------------------------
\20\ FinCEN, Financial Trend Analysis, Ransomware Trends in Bank
Secrecy Act Data Between January 2021 and June 2021, Oct. 15, 2021,
at p. 13, available at https://www.fincen.gov/sites/default/files/2021-10/Financial%20Trend%20Analysis_Ransomware%20508%20FINAL.pdf
(FinCEN October 2021 FTA).
---------------------------------------------------------------------------
f. Facilitating user-initiated delays in transactional activity:
This method involves the use of software, programs, or other technology
that programmatically carry out pre-determined timed-delay of
transactions by delaying the output of a transaction in order to make
that transaction appear to be unrelated to transactional input, thereby
decreasing the probability of determining both intended persons for
each unique transaction.
B. Use of CVC Mixing by Illicit Foreign Actors
Illicit actors use enhanced anonymity on the blockchain to avoid
detection by authorities as they launder their illicit proceeds. By
obfuscating identity and preventing the attribution of ownership of
CVC,\21\ CVC mixing allows illicit actors, such as cyber threat actors
carrying out ransomware attacks or cyber heists, to launder their CVC
and convert it into fiat currency, minimizing the risk of being
detected by involved financial institutions, including VASPs, or
relevant authorities. Because wallet addresses are pseudonymous and CVC
mixing severs the connection between the identity of users sending and
receiving CVC, illicit actors are able to exploit vulnerabilities in
anti-money laundering and countering the financing of terrorism (AML/
CFT) regulatory frameworks,\22\ threatening the effectiveness of rules
which require financial institutions to, among other things, know the
identity of their customers and report suspicious activity to FinCEN.
---------------------------------------------------------------------------
\21\ Users employ digital wallets to hold their CVC. These
wallets appear on the blockchain as a string of alphanumeric
characters, but can be created using software at will, and are not
directly tied to any individual person's identity.
\22\ See Treasury April 2023 Defi Risk Assessment, at pp. 3-4,
28.
---------------------------------------------------------------------------
Over the past few years, Treasury has monitored, and expressed
concern with, the increasing use of CVC mixing by illicit actors,
including North Korea-affiliated cyber threat actors, ransomware
actors, and darknet market \23\ participants, to transfer and launder
their illicit proceeds. In particular, the DPRK--already under pressure
from robust United States, European Union, United Kingdom, and United
Nations sanctions--relies upon CVC mixing to launder the proceeds of
cyber heists in order to finance the DPRK's WMD program.\24\ The Axie
Infinity Ronin Bridge (Axie Infinity) heist--committed in March 2022,
worth almost $620 million and carried out by the DPRK-controlled
Lazarus Group--remains, for instance, the largest cyber heist to
date,\25\ and made high profile use of at least two mixers to launder
the proceeds of the theft--Blender.io and Tornado Cash.\26\
---------------------------------------------------------------------------
\23\ ``Darknet'' is a term used to refer to networks that are
only accessible through the use of specific software or network
configurations. Darknet content is not indexed by web search
engines, and is often accessed via anonymized, encrypted systems
like the software The Onion Router (TOR). Darknet markets are online
markets only accessible with the use of software like TOR, and
because they are not indexed, can only be found if the domain name
and URL are already known to the user. As a result of the inherent
anonymity of the darknet infrastructure, darknets facilitate
criminal activity because of the difficulty involved for law
enforcement in identifying users, infrastructure, and even domains
associated with the sale of illicit goods and services. FinCEN's
August 2021 publicly available assessment of a civil money penalty
against an exchange noted that darknet marketplaces actively promote
CVC mixers as the primary method for obfuscating CVC transactions.
\24\ United Nations, UN Panel of Experts Letter, S/2023/171,
Mar. 7, 2023, at p. 4, available at https://documents-dds-ny.un.org/doc/UNDOC/GEN/N23/037/94/PDF/N2303794.pdf?OpenElement (UN March 2023
Experts Letter); see Wall Street Journal, North Korea Suspected of
Plundering Crypto to Fund Weapons Programs, July 1, 2022, available
at https://www.wsj.com/articles/north-korea-suspected-of-plundering-crypto-to-fund-weapons-programs-11656667802.
\25\ Office of Foreign Assets Control (OFAC), U.S. Treasury
issues First Ever Sanctions on Virtual Currency Mixer, Targets DPRK
Cyber Threats, May 6, 2022, available at https://home.treasury.gov/news/press-releases/jy0768 (U.S. Treasury May 2022 Press Release);
see Elliptic, North Korea's Lazarus Group Identified as Exploiters
Behind $540 Million Ronin Bridge Heist, Apr. 14, 2022, available at
https://www.elliptic.co/blog/540-million-stolen-from-the-ronin-defi-bridge.
\26\ OFAC, Treasury Designates DPRK Weapons Representative, Nov.
8, 2022, available at https://home.treasury.gov/news/press-releases/jy1087 (U.S. Treasury November 2022 Press Release).
---------------------------------------------------------------------------
[[Page 72704]]
CVC mixing is also commonly used to obfuscate the source of CVC
obtained through other illicit activities, such as ransomware attacks
and the use and operation of darknet markets. For example, between
January 2021 and June 2021, the top 10 most common ransomware variants
reported in suspicious activity report (SAR) data, including several
Russian-affiliated variants, sent approximately $35.2 million to CVC
mixers and $252 million to darknet markets.\27\ Indeed, darknet
marketplaces actively promote CVC mixers as the primary method for
obfuscating related transactions, and, indeed, multiple CVC mixers
historically interacted with Hydra, the former Russian darknet market
that accounted for approximately 80 percent of all darknet market CVC
transactions in 2021 before being shut down by United States and German
law enforcement.\28\ Because darknet marketplaces are fundamentally
illicit in nature, FinCEN assesses that illicit actors using darknet
markets to purchase or sell illicit goods favor the ability to reduce
the odds of being identified and leverage CVC mixing to enhance
anonymity to that end. Similarly, ransomware actors also prefer an
opportunity to successfully launder their illicit funds by using CVC
mixing to enhance anonymity.
---------------------------------------------------------------------------
\27\ See FinCEN October 2021 FTA, at p. 17.
\28\ U.S. Department of Justice (DOJ), Justice Department
Investigation Leads To Shutdown Of Largest Online Darknet
Marketplace, Apr. 5, 2022, available at https://www.justice.gov/usao-ndca/pr/justice-department-investigation-leads-shutdown-largest-online-darknet-marketplace.
---------------------------------------------------------------------------
The multiple U.S. Government actions against CVC mixers, often in
coordination with international partners, demonstrate that CVC mixing
provides illicit actors with enhanced anonymity in CVC transactions,
allowing them to more easily launder their illicit proceeds in CVC.\29\
---------------------------------------------------------------------------
\29\ FinCEN, First Bitcoin ``Mixer'' Penalized by FinCEN for
Violating Anti-Money Laundering Laws, Oct. 19, 2020, available at
https://www.fincen.gov/news/news-releases/first-bitcoin-mixer-penalized-fincen-violating-anti-money-laundering-laws (First Bitcoin
``Mixer'' Penalized by FinCEN, October 19, 2020); DOJ, Ohio Resident
charged operating darknet based bitcoin mixer laundered over 300
million, Feb. 13, 2020, available at https://www.justice.gov/opa/pr/ohio-resident-charged-operating-darknet-based-bitcoin-mixer-which-laundered-over-300-million; DOJ, Justice Department Investigation
leads to takedown of Darknet cryptocurrency mixer processed over $3
billion of unlawful transactions, Mar. 15, 2023, available at
https://www.justice.gov/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3 (DOJ
March 2023 Press Release); U.S. Treasury November 2022 Press
Release.
---------------------------------------------------------------------------
IV. Finding That Transactions That Involve CVC Mixing Within or
Involving a Jurisdiction Outside the United States Are a Class of
Transactions of Primary Money Laundering Concern
Pursuant to 31 U.S.C. 5318A(a)(1), FinCEN finds that reasonable
grounds exist for concluding that transactions involving CVC mixing
within or involving a jurisdiction outside the United States are a
class of transactions that is of primary money laundering concern. In
making this finding, FinCEN considered the following statutory factors:
(1) the extent to which the class of transactions is used to facilitate
or promote money laundering in or through a jurisdiction outside of the
United States, including money laundering activity with connections to
international terrorism, organized crime, and proliferation of WMDs and
missiles; (2) the extent to which a class of transactions is used for
legitimate business purposes; and (3) the extent to which action by
FinCEN would guard against international money laundering and other
financial crimes.
A. The Extent to Which the Class of Transactions Is Used To Facilitate
or Promote Money Laundering in or Through a Jurisdiction Outside the
United States, Including Any Money Laundering Activity by Organized
Criminal Groups, International Terrorists, or Entities Involved in the
Proliferation of WMD and Missiles
FinCEN assesses that foreign CVC mixing transactions are used to
facilitate or promote money laundering in or through jurisdictions
outside the United States, including by organized criminal groups,
international terrorists, or entities involved in the proliferation of
WMD and missiles. FinCEN based this assessment on information available
to the agency, including both public and non-public reporting, and
after thorough consideration of each of the following factors: (1) that
transactions involving CVC mixing often occur within, or involve,
jurisdictions outside of the United States; (2) that CVC mixing is used
to launder proceeds of large-scale CVC theft and heists, and support
the proliferation of WMD, in particular, by the DPRK; and (3) that CVC
mixing is similarly used by ransomware actors and darknet markets to
launder illicit proceeds.
1. CVC Mixing Transactions Often Occur Within or Involve Jurisdictions
Outside the United States
CVC mixers conduct business with opaque operational structures and
take steps to avoid the discovery of where they and their users are
located. CVC mixers commonly obscure their locations, including (1)
employing The Onion Router (TOR) to conceal the location of their
servers; \30\ (2) failing to register as a business in any
jurisdiction; and (3) failing to maintain any activity logs. Based on
public and non-public information, FinCEN assesses that CVC mixing
activity often occurs within or involves numerous jurisdictions outside
the United States and, indeed, throughout the world. The U.S.
Department of Justice (DOJ) and open source reporting identified an
increase in the use of CVC in terror finance, including by Hamas and
the Islamic State of Iraq and Syria (ISIS), and the use of CVC mixers
to obfuscate source of funds to protect the identity of their
donors.\31\ In addition, FinCEN has identified the use of CVC mixing
services as a prevalent money laundering typology for the top 10
ransomware strains identified in BSA data from January 2021 to June
2021, and, notably, open source analysis of CVC payments indicates that
up to 74 percent of ransomware activity is associated with Russia.\32\
---------------------------------------------------------------------------
\30\ See DOJ March 2023 Press Release.
\31\ DOJ, Four Defendants Charged with Conspiring to Provide
Cryptocurrency to ISIS, Dec. 14, 2022, available at https://www.justice.gov/usao-edny/pr/four-defendants-charged-conspiring-provide-cryptocurrency-isis; TRM Labs, Terrorist Financing Six
Crypto Related Trends to Watch in 2022, Feb. 16, 2023, available at
https://www.trmlabs.com/post/terrorist-financing-six-crypto-related-trends-to-watch-in-2023.
\32\ Chainalysis, Russian Cybercriminals Drive Significant
Ransomware and Cryptocurrency-based Money Laundering Activity, Feb.
14, 2022, available at https://www.chainalysis.com/blog/2022-crypto-crime-report-preview-russia-ransomware-money-laundering/.
---------------------------------------------------------------------------
The global nature of the problem is further demonstrated by the
fact that no CVC mixers are currently registered with FinCEN. CVC
mixers are required to register with FinCEN if they do business as
money transmitters wholly or in substantial part within the United
States.\33\ To the extent foreign CVC mixers are operating beyond
United States jurisdiction, they are not subject to U.S. regulations
that require financial institutions to, among other things, know the
identity of their customers and report suspicious activity to FinCEN.
Nevertheless, FinCEN assesses that other forms of CVC mixing, that do
not involve the use of CVC mixers, do occur within the United States.
---------------------------------------------------------------------------
\33\ 31 CFR 1010.100(ff).
---------------------------------------------------------------------------
Recent U.S. and foreign enforcement actions also reflect CVC mixing
transactions within or involving numerous foreign jurisdictions,
including DPRK, Russia, Luxembourg,
[[Page 72705]]
the Netherlands, and Vietnam. Office of Foreign Assets Control (OFAC)
actions in 2022, for instance, highlighted the links between the DPRK
and CVC mixers Blender.io \34\ and Tornado Cash \35\--through their
respective involvement in the Axie Infinity heist \36\ in March 2022
and Tornado Cash's involvement in the Harmony Horizon Bridge (Harmony)
heist \37\ in June 2022.\38\ The coordinated international takedown of
ChipMixer, a darknet CVC ``mixing'' service operated by Vietnamese
national Minh Qu)c Nguy(n in Hanoi, Vietnam, by the DOJ and the German
Federal Criminal Police (Bundeskriminalamt or BKA) on March 15, 2023,
and shutdown of Bestmixer.io and associated seizure of servers located
in the Netherlands and Luxembourg by the Dutch Fiscal Information and
Investigation Service (FIOD), in close cooperation with Europol and
Luxembourg authorities on May 22, 2019,\39\ similarly demonstrate the
international character of CVC mixing transactions--spanning
jurisdictions across Europe and Asia.
---------------------------------------------------------------------------
\34\ See U.S. Treasury May 2022 Press Release.
\35\ See U.S. Treasury November 2022 Press Release.
\36\ Federal Bureau of Investigation (FBI), FBI Statement of
Attribution of Malicious Cyber Activity Posed by the Democratic
People's Republic of Korea, Apr. 14, 2022, available at https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea.
\37\ FBI, FBI Confirms Lazarus Group, APT 38 Cyber Actors
Responsible for Harmony's Horizon Bridge Currency Theft, Jan. 23,
2023, available at https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft (FBI January 23, 2023 Press Release).
\38\ See Dutch Fiscal Information and Investigation Service,
Arrest of suspected developer of Tornado Cash, Aug. 12, 2022,
available at https://www.fiod.nl/arrest-of-suspected-developer-of-tornado-cash/; DOJ, Tornado Cash Founders Charged with Money
Laundering and Sanctions Violations, Aug. 23, 2023, available at
https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations; OFAC, Treasury Designates
Roman Semenov, Co-Founder of Sanctioned Virtual Currency Mixer
Tornado Cash,Aug. 23, 2023, available at https://home.treasury.gov/news/press-releases/jy1702; OFAC, Sanctions List Search, Aug. 24,
2023, available at https://sanctionssearch.ofac.treas.gov/Details.aspx?id=44718.
\39\ The European Union Agency for Law Enforcement Cooperation
(Europol), Multi-million euro cryptocurrency laundering service
Bestmixer.io taken down, May 22, 2019, available at https://www.europol.europa.eu/media-press/newsroom/news/multi-million-euro-cryptocurrency-laundering-service-bestmixerio-taken-down; DOJ March
2023 Press Release.
---------------------------------------------------------------------------
2. CVC Mixing Is Used To Launder Proceeds of Large-Scale CVC Theft and
Heists
FinCEN assesses that CVC mixing is used to launder the proceeds of
large-scale CVC theft and heists by both state and non-state sponsored
actors. Whether heists are carried out by state or non-state actors,
the need for CVC mixing is the same--illicit CVC must be laundered, and
CVC mixing provides the enhanced anonymity to separate illicitly
obtained CVC from the underlying illicit activity.
Non-state-affiliated actors commonly use CVC mixing services to
launder their proceeds from large scale heists. The proceeds from the
heists that targeted a CVC exchanger \40\ and cross-chain bridge Nomad
\41\ were, for instances, laundered using the Tornado Cash CVC mixer.
---------------------------------------------------------------------------
\40\ CoinDesk, Crypto.com's Stolen Ether Being Mixed Through
Tornado Cash (Updated May 11, 2023), available at https://www.coindesk.com/business/2022/01/18/cryptocoms-stolen-ether-being-laundered-via-tornado-cash/; see Halborn, Explained: the Crypto.com
Hack (January 2022), Jan. 24, 2022, available at https://halborn.com/explained-the-crypto-com-hack-january-2022/ (accessed
Nov. 15, 2022).
\41\ See U.S. Treasury November 2022 Press Release; Reuters,
U.S. crypto firm Nomad hit by $190 million theft, Aug. 3, 2022,
available at https://www.reuters.com/technology/us-crypto-firm-nomad-hit-by-190-million-theft-2022-08-02/.
---------------------------------------------------------------------------
In addition to the use of CVC mixing by non-state-affiliated
actors, FinCEN assesses that, based on public and non-public reporting,
DPRK state-sponsored or -affiliated cyber threat actors are responsible
for a substantial portion of illicit or stolen CVC funds sent to CVC
mixers,\42\ and that the DPRK utilized CVC mixing to launder proceeds
in an attempt to obfuscate its connection to those funds. The DPRK uses
the mixed proceeds of these thefts to support its WMD
program.43 44 A publicly available analysis in
February 2021 determined that individuals acting for or on behalf of
the North Korean government laundered more than 65 percent of stolen
CVC through CVC mixers--an increase from 42 percent in 2020 and 21
percent in 2019.\45\ Further, publicly available analysis in February
2022 assessed that the DPRK is a systematic money launderer and that
its use of multiple CVC mixers is a calculated attempt to obscure the
origins of its ill-gotten CVCs while converting them into fiat
currency.\46\ In the same year, there was a notable increase in large
scale heists carried out by, or in support of, the DPRK, with
associated use of CVC mixing and CVC mixers. OFAC sanctioned two CVC
mixers, Blender.io and Tornado Cash, used to launder illicit proceeds
of the March 2022 Axie Infinity heist and the June 2022 Harmony heist,
both of which were carried out by North Korea's Lazarus
Group.47 48 In addition, DOJ has determined that
ChipMixer processed over $700 million in Bitcoin associated with wallet
addresses identified as containing stolen CVC, including CVC related to
the Axie Infinity and the Harmony heists.\49\ The Federal Bureau of
Investigation (FBI) has also determined that North Korean cyber actors
laundered over $60 million worth of Ethereum stolen during the Harmony
heist through RAILGUN, a United Kingdom-based CVC mixer.50
51 52 Importantly, DPRK-sponsored and -affiliated
actors' desire to rely on CVC mixing appears unlikely to abate. Most
recently, in August 2023 the FBI attributed the June 2023 Atomic Wallet
heist to the Lazarus Group, and open-source reporting indicates that
the Lazarus Group used specific services including Sinbad, a CVC mixer,
to launder the stolen CVC.53 54
---------------------------------------------------------------------------
\42\ See Chainalysis, The Crypto Crime Report 2023, available at
https://go.chainalysis.com/2023-crypto-crime-report.html (The 2023
Crypto Crime Report).
\43\ See U.S. Treasury November 2022 Press Release; see also
FinCEN, Imposition of Special Measure Against North Korea as a
Jurisdiction of Primary Money Laundering Concern, 81 FR 78715, Nov.
9, 2016, available at https://www.fincen.gov/sites/default/files/shared/2016-27049.pdf (FinCEN 2016 Imposition of Special Measure
Against North Korea).
\44\ See UN March 2023 Experts Letter, at p. 4.
\45\ Chainalysis, Crypto Money Laundering: Four Exchange Deposit
Addresses Received Over $1 Billion in Illicit Funds in 2022, Jan.
26, 2023, available at https://blog.chainalysis.com/reports/crypto-money-laundering-2022/. (Crypto Money Laundering: Four Exchange).
\46\ Chainalysis, The 2022 Crypto Crime Report, Feb. 2022,
available at https://go.chainalysis.com/2022-crypto-crime-report.html (The 2022 Crypto Crime Report); see Chainalysis, North
Korean Hackers Have Prolific Year as Their Unlaundered
Cryptocurrency Holdings Reach All-time High, Jan. 13, 2022,
available at https://blog.chainalysis.com/reports/north-korean-hackers-have-prolific-year-as-their-total-unlaundered-cryptocurrency-holdings-reach-all-time-high/.
\47\ See U.S. Treasury May 2022 Press Release.
\48\ See U.S. Treasury November 2022 Press Release.
\49\ See DOJ March 2023 Press Release.
\50\ According to open-source reporting, RAILGUN is
headquartered in London, England.
\51\ FinCEN assesses that RAILGUN falls under the umbrella of
CVC mixing, as defined by this NPRM, because it uses its privacy
protocol to manipulate the structure of the transaction to appear as
being sent from the RAILGUN contract address, thus obscuring the
true originator.
\52\ See FBI January 23, 2023 Press Release.
\53\ FBI, FBI Identifies Cryptocurrency Funds Stolen by DPRK,
Aug. 22, 2023, available at https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk.
\54\ Elliptic, North Korea's Lazarus Group likely responsible
for $35 Million Atomic Crypto Theft, June 6, 2023, available at
https://hub.elliptic.co/analysis/north-korea-s-lazarus-group-likely-
responsible-for-35-million-atomic-crypto-theft/
#:~:text=Elliptic's%20analysis%20suggests%20that%20North,with%20five%
20million%20users%20worldwide.
---------------------------------------------------------------------------
In brief, non-state actors and, significantly, DPRK state-sponsored
or -affiliated cyber threat actors have
[[Page 72706]]
repeatedly used, and continue to use, CVC mixing to launder illicit
proceeds from large-scale CVC theft and heists.
3. CVC Mixing Is Used by Ransomware and Darknet Markets
CVC mixing services that obfuscate blockchain trails are attractive
for cybercriminals looking to launder illegal proceeds from malicious
cyber-enabled activities, including ransomware attacks.\55\ FinCEN
assesses that threat actors avoiding reusing wallets, using CVC mixing
services, and ``chain hopping'' have been prevalent associated money
laundering typologies.\56\ Open-source analysis in July 2022 reported
that nearly 10 percent of all CVC sent from addresses tied to illicit
activity were sent to CVC mixers, while no other service type exceeded
a 0.3 percent CVC mixer sending share.\57\ FinCEN's analysis of the top
10 CVC mixers by volume per commercially available data determined that
approximately 33 percent of all deposits as of August 2022 were
attributed to high risk sources, with 13 percent of all deposits coming
from known illicit activities.\58\ More significantly, only a portion
of the activity in the CVC ecosystem with exposure to CVC mixing is
captured by BSA reporting. As a result, FinCEN assesses that high-risk
deposits into CVC mixers are likely underreported, and the percent of
CVC tied to illicit activity is likely higher.
---------------------------------------------------------------------------
\55\ Europol, One of the darkweb's largest cryptocurrency
laundromats washed out, Mar. 15, 2023, available at https://www.europol.europa.eu/media-press/newsroom/news/one-of-darkwebs-largest-cryptocurrency-laundromats-washed-out.
\56\ See FinCEN October 2021 FTA. FinCEN examined ransomware-
related SARs filed between January 1, 2021, and June 30, 2021, to
determine trends. The full data set consisted of 635 SARs reporting
$590 million in suspicious activity. From this data, FinCEN
identified the top 10 most common ransomware variants and analyzed
their indicators of compromise through commercially available
analytics tools. USD figures cited in this analysis are based on the
value of BTC when the transactions occurred.
\57\ Chainalysis, Crypto Mixer Usage Reaches All-time Highs in
2022 With Nation State Actors and Cybercriminals Contributing
Significant Volume, July 14, 2022, available at https://blog.chainalysis.com/reports/cryptocurrency-mixers/.
\58\ In August 2022, FinCEN analyzed 10 mixers, finding that
these services processed more than $20 billion in total volume
between January 2011 and August 2022. The majority of this total
occurred between January 2021 and August 2022. FinCEN assessed what
sources constituted high risk and illicit activites based on
commercial source attributions of entities.
---------------------------------------------------------------------------
The relationship between CVC mixing and malicious cyber-enabled and
other criminal activities is evident through the reliance of ransomware
actors on CVC mixing. The Financial Action Task Force (FATF) identified
this connection, noting in 2022 the ongoing and growing threat of
criminal misuse of CVC for the receipt and laundering of illicit
proceeds from ransomware attacks, expressing particular concern that
ransomware cybercriminals are increasingly using CVC mixers to launder
their illicit proceeds.\59\ Similarly, between January and June 2021,
FinCEN observed the use of CVC mixing services (as reflected in BSA
reporting of suspicious activity) with the top 10 ransomware strains
identified as sending approximately $35.2 million to CVC mixers. During
this same time period FinCEN also observed ``chain hopping'' by
ransomware actors to obfuscate the orgin of their proceeds as well as
that ransomware actors layered funds through multiple wallet addresses
and avoided reusing wallet addresses for each attack. The most
prevalent ransomware variants observed by FinCEN between January and
June 2021 were Russia-affiliated REvil/Sodinokibi, and Conti,\60\ and
Russian-speaking DarkSide, Avaddon, and Phobos.61 62
---------------------------------------------------------------------------
\59\ FATF, Targeted Update On Implementation Of The FATF
Standards On Virtual Assets And Virtual Asset Service Providers,
June 2022, p. 24, available at https://www.fatf-gafi.org/media/fatf/documents/recommendations/Targeted-Update-Implementation-FATFStandards-VirtualAssets-VASPs.pdf.
\60\ See U.S. Treasury May 2022 Press Release. OFAC identified
Conti and Sodinokibi as Russian-linked malign ransomware groups in
their designation of Blender.io on May 6, 2022.
\61\ Id.
\62\ See FinCEN October 2021 FTA.
---------------------------------------------------------------------------
The relationship between CVC mixing and illicit activities is
likewise prevalent in transactions involving darknet markets. CVC
mixing services often deliberately operate opaquely and advertise their
services as a way to pay anonymously for illicit items such as illegal
narcotics, firearms, and child sexual abuse material.\63\ According to
DOJ, the mixer Bitcoin Fog--the longest running Bitcoin money
laundering service on the darknet--laundered CVC from darknet
marketplaces tied to illegal narcotics, computer fraud and abuse
activities, and identity theft.\64\ Additionally, according to the
Government Accountability Office and DOJ, the dismantled darknet market
Alphabay allegedly not only sold and purchased various illegal drugs,
illicit goods, and services with CVC, but also allegedly provided
mixing services, via the CVC mixer Helix, to obfuscate CVC transactions
on the site.65 66
---------------------------------------------------------------------------
\63\ See First Bitcoin ``Mixer'' Penalized by FinCEN, October
19, 2020.
\64\ DOJ, Individual Arrested and Charged with Operating
Notorious Darknet Cryptocurrency `Mixer', Apr. 28, 2021, available
at https://www.justice.gov/opa/pr/individual-arrested-and-charged-operating-notorious-darknet-cryptocurrency-mixer.
\65\ United States Government Accountability Office, VIRTUAL
CURRENCIES Additional Information Could Improve Federal Agency
Efforts to Counter Human and Drug Trafficking, Dec. 2021, p. 29,
available at https://www.gao.gov/assets/gao-22-105462.pdf.
\66\ DOJ, Ohio Resident Pleads Guilty to Operating Darknet-Based
Bitcoin `Mixer' That Laundered Over $300 Million, Aug. 18, 2021,
available at https://www.justice.gov/opa/pr/ohio-resident-pleads-guilty-operating-darknet-based-bitcoin-mixer-laundered-over-300-million.
---------------------------------------------------------------------------
As these examples demonstrate, illicit actors of all types
conducting illicit cyber activity, including ransomware attacks and
transactions on darknet markets, frequently seek out services that mask
their illicit transactions and favor the enhanced anonymity provided by
CVC mixing. Furthermore, FinCEN assesses that the percentage of mixing
activity attributed to illicit activity is increasing. According to
publicly available analysis reported in January 2023, the total amount
of CVC sent to CVC mixers fell significantly, likely due to OFAC
designation of two CVC mixers, Blender.io and Tornado Cash. However,
the analysis noted the CVC that was sent to CVC mixers in 2022 was more
likely to come from illicit sources than in previous years--24 percent
of the $7.8 billion \67\ processed by mixers in 2022 versus 10 percent
of the $11.5 billion processed by mixers in 2021.\68\ This shift
constitutes a 62.78 percent increase in the illicit value flowing
through CVC mixers, year over year.\69\
---------------------------------------------------------------------------
\67\ See The 2023 Crypto Crime Report, p. 46.
\68\ See Crypto Money Laundering: Four Exchange.
\69\ Although this analysis assessed only CVC sent to CVC mixers
without considering other forms of CVC mixing (as identified by this
NPRM), its findings are nevertheless instructive.
---------------------------------------------------------------------------
B. The Extent to Which the Class of Transactions Is Used for Legitimate
Business Purposes
FinCEN recognizes that there are legitimate reasons why responsible
actors might want to conduct financial transactions in a secure and
private manner given the amount of information available on public
blockchains. FinCEN also recognizes that, in addition to illicit
purposes, CVC mixing may be used for legitimate purposes, such as
privacy enhancement for those who live under repressive regimes or wish
to conduct licit transactions anonymously.\70\ Still, CVC mixing
presents an acute money laundering risk because it shields information
from
[[Page 72707]]
responsible third parties, such as financial institutions and law
enforcement.
---------------------------------------------------------------------------
\70\ Chainalysis, Crypto Mixers and AML Compliance, August 23,
2022, available at https://blog.chainalysis.com/reports/crypto-mixers/; see Elliptic, What are Bitcoin Mixers & Are They Compliant
With AML Standards?, May 7, 2018, available at https://elliptic.co/blog/bitcoin-mixers-assessing-risk-bitcoin-transactions.
---------------------------------------------------------------------------
FinCEN is concerned that CVC mixing makes CVC flows untraceable by
law enforcement and makes potentially suspicious transactions
unreportable by responsible financial institutions--thereby fostering
illicit activity as described elsewhere in this document. More
importantly, FinCEN assesses that the percentage of CVC mixing activity
attributed to illicit activity is increasing. At the same time, because
of the lack of available transactional information, FinCEN cannot fully
assess the extent to which, or quantity thereof, CVC mixing activity is
attributed to legitimate business purposes.
Thus, the legitimate applications of CVC mixing must be carefully
weighed against the exposure of the U.S. financial system to ongoing
illicit use of CVC mixing. Given the substantial risks posed by CVC
mixing, the fact that CVC mixing can be used for some legitimate
business purposes does not alter FinCEN's conclusion that this class of
transactions is of primary money laundering concern.
C. The Extent to Which Action by FinCEN Would Guard Against
International Money Laundering and Other Financial Crimes
Given the threats posed to U.S. national security and the U.S.
financial system by obfuscation of illicit proceed flows through CVC
mixing, FinCEN believes that imposing recordkeeping and reporting
requirements under special measure one would guard against
international money laundering and other financial crimes by increasing
transparency in these transactions, and thus render them less
attractive to illicit actors while also providing additional
information to support law enforcement investigations.
This additional transparancy would serve two purposes. First, it
would enable investigations by law enforcement and regulators to
support money laundering investigations, including cases against North
Korean and Russian cybercriminals that pose a threat to U.S national
security and the U.S. financial system. Second, it would highlight the
risks and deter illicit actors' use of CVC mixing services, including
by foreign state-sponsored or -affiliated cyber actors' laundering
proceeds of CVC theft to facilitate WMD proliferation, ransomware
attackers' laundering of ransoms, and obfuscation of transactions
associated with the use of illicit darknet markets.
V. Proposed Enhanced Recordkeeping and Reporting by Covered Financial
Institutions Where a Covered Financial Institution Knows, Suspects, or
Has Reason To Suspect a Transaction Involves CVC Mixing Within or
Involving a Jurisdiction Outside the United States
Having found that transactions involving CVC mixing within or
involving a jurisdiction outside the United States are a class of
transactions that are of primary money laundering concern, FinCEN
proposes imposing recordkeeping and reporting obligations on covered
financial institutions under special measure one. Such recordkeeping
and reporting obligations would require covered financial institutions
to report certain information when they know, suspect, or have reason
to suspect a CVC transaction involves the use of CVC mixing within or
involving a jurisdiction outside the United States.
FinCEN believes that this special measure is the best available
tool to mitigate the risks posed by CVC mixing. It would appropriately
collect information, which will discourage the use of CVC mixing by
illicit actors, and is necessary to better understand the illicit
finance risk posed by CVC mixing and investigate those who seek to use
CVC mixing for illicit ends. At the same time, this special measure
will minimize the burden upon financial institutions and those who seek
to use mixing for legitimate purposes. The reporting obligations under
this special measure apply to covered financial institutions that
directly engage with CVC transactions, such as exchangers, and do not
encompass indirect fiat transactions by covered U.S. financial
institutions, such as a bank sending funds on behalf of a CVC exchanger
that is acting on behalf of a customer purchasing CVC previously
processed through a CVC mixer.
As proposed by FinCEN, special measure one would require
recordkeeping and reporting of biographical and transactional
information related to transactions involving CVC mixing, increasing
transparency and thereby rendering the use of CVC mixing services by
illicit actors less attractive. Furthermore, the information generated
by this special measure would support investigations into illicit
activities by actors who make use of CVC mixing to launder their ill-
gotten CVC by law enforcement. At present, there is no similar or
equivalent mechanism possessed by law enforcement to readily collect
such information, depriving investigators of the information necessary
to more effectively understand, investigate, and hold illicit actors
accountable. Collectively, the outcomes of the proposed recordkeeping
and reporting requirement--discouraging the use of CVC mixing by
illicit actors and closing the information gap in service of increased
investigation of those illicit actors who continue to make use of CVC
mixing--will aid in the protection of the U.S. financial system.
FinCEN has determined that imposition of special measure one would
most appropriately collect necessary information while limiting the
burden placed on covered financial institutions and users of CVC
mixing. As set out further below in Section V.B., FinCEN believes that
the existing risk-based approach to AML/CFT compliance used by covered
financial institutions already largely encompasses the information
FinCEN is requesting. Despite this ready availability of information,
covered financial institutions do not, and often need not, universally
report that information to FinCEN at present. The proposed reporting
requirement would address this reporting gap.
FinCEN considered the other special measures available under
section 311. As discussed further in Section V.E. below, it determined
that none of them would appropriately balance the interests in
permitting secure and private financial transactions while addressing
the risks posed by CVC mixing, or were otherwise ill-suited to CVC-
related transactions, and thus incapable of collecting information
necessary to add transparency to them. Moreover, FinCEN also considered
the appropriate scope of the proposed recordkeeping and reporting
requirements, and determined that the proposed approach would best
capture necessary information and mitigate risks associated with CVC
mixing and facilitate investigations of illicit actors, while
preserving legitimate actors' ability to continue conducting secure and
private financial transactions.
In proposing this special measure, FinCEN consulted with the
Chairman of the Board of Governors of the Federal Reserve System, the
Office of the Comptroller of the Currency, the Secretary of State,
certain staff of the Securities and Exchange Commission, the Commodity
Futures Trading Commission, the National Credit Union Administration
Board, the Federal Deposit Insurance Corporation, and the Attorney
General. These consultations involved obtaining interagency views on
the imposition of the proposed recordkeeping and reporting
[[Page 72708]]
requirements and the effect that such a recordkeeping and reporting
requirements would have on the domestic and international financial
system.
Below is a discussion of the relevant statutory factors FinCEN
considered in proposing these recordkeeping and reporting requirements.
A. Whether Similar Action Has Been or Is Being Taken by Other Nations
or Multilateral Groups
FinCEN is not aware of any other nation or multilateral group that
has imposed, or is currently imposing, similar recordkeeping and
reporting requirements relating to transactions involving CVC mixing.
However, having likewise identified the significant money laundering
threat that CVC mixing poses, numerous other nations and certain
multilateral groups have issued public statements regarding the risks
presented by CVC mixing, called for appropriate regulation, and/or
taken action against specific CVC mixers. Several countries--such as
Australia, Canada, and Seychelles--and multilateral groups, such as
FATF and Europol, have identified CVC mixing as a risk indicator for
money laundering or terrorist financing and have found that CVC mixing
can make it more difficult for law enforcement to trace and attribute
transactions, complicating investigations.\71\ Japan requires
information from VASPs on their exposure to CVC mixing services to
assess their risk exposure and assign risk ratings.\72\ Moreover, as
discussed above, numerous countries have investigated and prosecuted
individual CVC mixers and associated persons engaged in or facilitating
illicit activities. These efforts are generally not as expansive as
FinCEN's proposed rule would be. However, FinCEN's identification of
CVC mixing as a class of transactions of primary laundering concern and
proposed special measure may support efforts of other countries by
clearly outlining the illicit finance risks associated with CVC mixing
and demonstrating means of enhancing transparency as well as mitigating
these risks.
---------------------------------------------------------------------------
\71\ See AUSTRAC, Preventing the Criminal Abuse of Digital
Currencies Financial Crime Guide, Apr. 2022, pp. 1, 15-17, available
at https://www.austrac.gov.au/sites/default/files/2022-04/AUSTRAC_FCG_PreventingCriminalAbuseOfDigitalCurrencies_FINAL.pdf;
Government of Canada, Updated Assessment of Inherent Risks of Money
Laundering and Terrorist Financing in Canada, Mar. 2023, available
at https://www.canada.ca/en/department-finance/programs/financial-sector-policy/updated-assessment-inherent-risks-money-laundering-terrorist-financing-canada.html; Republic of Seychelles, ML/TF
Overall National Risk Assessment for VA & VASPs, July 2022, pp. 32,
43, available at https://www.cbs.sc/Downloads/publications/aml/ReportSeychellesONRAML-TFofVAandVASP-26.08.2022.pdf; Europol,
Seizing the Opportunity: 5 Recommendations For Crypto-Assets Related
Crime And Money Laundering (2022), p. 6, available at https://www.europol.europa.eu/cms/sites/default/files/documents/2022_Recommendations_Joint_Working_Group_on_Criminal_Finances_and_Cryptocurrencies_.pdf; FATF, Updated Guidance for a Risk-Based
Approach, Oct. 2021.
\72\ See FATF, Updated Guidance for a Risk-Based Approach, Oct.
2021, at p. 94.
---------------------------------------------------------------------------
B. Whether the Imposition of Any Particular Special Measure Would
Create a Significant Competitive Disadvantage, Including Any Undue Cost
or Burden Associated With Compliance, for Financial Institutions
Organized or Licensed in the United States
While FinCEN assesses that the recordkeeping and reporting
requirements proposed in this NPRM will place some cost and burden on
domestic financial institutions, these burdens are neither undue nor
inappropriate in view of the threat posed by the obfuscation of illicit
activity enabled by CVC mixing. The existing risk-based approach to
AML/CFT compliance used by covered financial institutions already
largely encompasses the information FinCEN is requesting. While the
information is available to covered financial institutions, at present
it is not universally reported to FinCEN. That is to say, FinCEN
assesses that covered financial institutions already possess customer
information and can identify when their customers engage in a covered
transaction. This proposed rule would compel covered financial
institutions to attribute a covered transaction to the involved
customer(s) and report this information to FinCEN. Accordingly, the
collection of the information in question would not create any undue
costs or burdens on covered financial institutions. Covered domestic
financial institutions may need to modify or replace the current
systems in place used to detect other types of illicit activity in
virtual currency transactions, such as sanctions compliance systems, to
detect transactions involving CVC mixing. Such burdens are commensurate
with established AML/CFT protocols.
C. The Extent to Which the Action or the Timing of the Action Would
Have a Significant Adverse Systemic Impact on the International
Payment, Clearance, and Settlement System, or on Legitimate Business
Activities Involving CVC Transactions
FinCEN assesses that imposition of the proposed special measure
would have minimal impact upon the international payment, clearance,
and settlement system, or on legitimate business activities involving
CVC transactions. As noted in the February 16, 2022, Financial
Stability Board's Assessment of Risks to Financial Stability, direct
connections between CVC and systemically important financial
institutions and core financial markets are limited at present.\73\
Volatility and disruptions in the CVC ecosystem have been contained
within the CVC markets and have not significantly spilled over to
financial markets and infrastructures.
---------------------------------------------------------------------------
\73\ Financial Stability Board, Assessment of Risks to Financial
Stability from Crypto-assets, Feb. 16, 2022, at p. 5, available at
https://www.fsb.org/wp-content/uploads/P160222.pdf.
---------------------------------------------------------------------------
D. The Effect of the Proposed Action on United States National Security
and Foreign Policy
As described above, CVC mixers are used by DPRK-affiliated and
Russia-affiliated threat actors, among others, to facilitate illicit
activities ranging from WMD proliferation to ransomware attacks
affecting victims in both the United States and around the world, and
whose interests are adversarial to the national security interests of
the United States. Imposing recordkeeping and reporting requirements on
transactions that involve CVC mixing will enhance financial
intelligence on the identity of illicit users who rely upon mixers to
obfuscate their identities and sources of CVC, as well as provide
insight into those CVC mixers that facilitate such illicit activity.
Such a rule would therefore best serve the national security interests
of the United States and support efforts to protect the United States
financial system from illicit finance threats.
E. Consideration of Alternative Special Measures
In assessing the appropriate special measure to impose, FinCEN
considered alternatives to imposing recordkeeping and reporting
requirements under special measure one. However, FinCEN believes that
recordkeeping and reporting requirements under special measure one
would most effectively safeguard the U.S. financial system from
[[Page 72709]]
the illicit finance risks posed by CVC mixing.
In particular, none of the other special measures available under
section 311 would appropriately balance the interests in permitting
secure and private financial transactions while addressing the risks
posed by CVC mixing or would be suited to CVC-related transactions. For
instance, FinCEN considered special measure two, which is designed to
obtain beneficial ownership information relating to accounts opened in
the United States by certain foreign persons or their agents. However,
FinCEN determined that such a special measure would fail to collect key
information of interest relating to CVC transactions that involve CVC
mixing such as the identity of the participants and beneficial owners
of the CVC involved. FinCEN also considered special measures three
through five, which are focused upon transactions conducted through
payable-through accounts and correspondent banking relationships and
determined that these are less relevant in the context of CVC
transactions, including those that involve CVC mixing, as CVC
transactions are conducted outside of the traditional banking system.
More broadly, FinCEN also considered the appropriate scope of the
proposed recordkeeping and reporting requirements. Of note, FinCEN
considered issuing a rule pursuant to section 311 that would have been
narrowly scoped to address terror finance involving Hamas and ISIS and/
or North Korea-sponsored and -affiliated actors. However, FinCEN
determined that such a narrow approach would be insufficient to address
the relevant risks detailed elsewhere in this action. Given the nature
and use of CVC mixing, covered financial institutions would typically
have insufficient information to determine whether the CVC transaction
was initiated North Korean-affiliated actors. FinCEN believes this
would be true of any similarly narrow approach, regardless of the
actors involved. Therefore, FinCEN has determined that additional
recordkeeping and reporting requirements set forth in this proposed
rule would best mitigate the risks associated with CVC mixing, deter
illicit actors, facilitate law enforcement investigations into illicit
activity, and adequately protect the U.S. financial system from the
illicit financial risk posed by CVC transactions that involve CVC
mixing, while preserving legitimate actors' ability to conduct secure
and private financial transactions.
VI. Section-by-Section Analysis of Proposed Regulations
The goal of this proposed rule is to implement an effective and
efficient reporting regime to combat and deter money laundering
associated with CVC mixing and increase transparency in a sector of the
United States virtual currency ecosystem with identified illicit
finance risks.
A. Definitions
1. Definition of Convertible Virtual Currency
The term ``convertible virtual currency'' or CVC, means a medium of
exchange that either has an equivalent value as currency, or acts as a
substitute for currency, but lacks legal tender status.\74\ Although
Bitcoin has legal tender status in at least two jurisdictions, the term
CVC includes Bitcoin for the purposes of this proposed rule.
---------------------------------------------------------------------------
\74\ As noted in note 17, FinCEN notes that CVC or ``virtual
currency'' by itself does not meet the definition of a ``currency''
under 31 CFR 1010.100(m). Additionally, the potential
characterization of CVC as currency, securities, commodities, or
derivatives for the purposes of any other legal regime, such as the
Federal securities laws or the Commodity Exchange Act, is outside
the scope of this proposed rule. However, as described in the FinCEN
2019 CVC Guidance, if assets that other regulatory frameworks
defined as commodities, securities, or futures contracts were to be
specifically issued or later repurposed to serve as a currency
substitute, then the asset itself could be a type of value that
substitutes for currency and be defined as CVC for the purposes of
this proposed rule, in addition to being subject to other applicable
regulatory frameworks.
---------------------------------------------------------------------------
2. Definition of CVC Mixing
The term ``CVC mixing'' means the facilitation of CVC transactions
in a manner that obfuscates the source, destination, or amount involved
in one or more transactions, regardless of the type of protocol or
service used, such as: (1) pooling or aggregating CVC from multiple
persons, wallets, addresses, or accounts; (2) using programmatic or
algorithmic code to coordinate, manage, or manipulate the structure of
a transaction; (3) splitting CVC for transmittal and transmitting the
CVC through a series of independent transactions; (4) creating and
using single-use wallets, addresses, or accounts, and sending CVC
through such wallets, addresses, or accounts through a series of
independent transactions; (5) exchanging between types of CVC or other
digital assets; or (6) facilitating user-initiated delays in
transactional activity.
This definition excepts the use of internal protocols or processes
to execute transactions by banks, broker-dealers, or money services
businesses, including VASPs, that would otherwise constitute CVC
mixing, provided that these financial institutions preserve records of
the source and destination of CVC transactions when using such internal
protocols and processes, and provide such records to regulators and law
enforcement, where required by law. This exemption is designed to avoid
capturing transactions with known VASPs that use these internal
protocols or processes as part of their business purpose and that are
positioned to appropriately respond to inquiries by law enforcement and
other relevant authorities. However, if the covered financial
institution is unsure if these processes are used as part of a business
purpose, they should collect the recordkeeping and reporting
information.
FinCEN is seeking to address the primary money laundering concern
posed by CVC mixing. The proposed definition of CVC mixing is designed
to capture methodologies used by illicit actors to break the
traceability of their illicit proceeds and create a mechanism on which
which covered businesses would be required to report when they observe
CVC mixing transactions. The exception to the definition is crafted to
avoid imposing undue burden on covered businesses, provided they are
also taking appropriate steps to ensure information is being retained
as prescribed by law.
3. Definition of CVC Mixer
The term ``CVC mixer'' means any person, group, service, code,
tool, or function that facilitates CVC mixing. FinCEN acknowledges this
definition is relatively broad; however, given the nature of CVC
mixing, FinCEN deems the breadth of this definition to be necessary.
4. Definition of Covered Financial Institution
The proposed rule defines ``covered financial institution'' as the
term is defined 31 CFR 1010.100(t), which in general includes the
following:
A bank (except bank credit card systems);
A broker or dealer in securities;
A money services business, as defined in 31 CFR 1010.100
(ff). This would include VASPs and other persons that provide money
transmission services, which ``. . . means the acceptance of . . .
value that substitutes for currency from one person and the
transmission of . . . value that substitutes for currency to another
[[Page 72710]]
location or person by any means . . .''; \75\
---------------------------------------------------------------------------
\75\ 31 CFR 1010.100(ff)(5)(A).
---------------------------------------------------------------------------
A telegraph company;
A casino;
A card club;
A person subject to supervision by any state or Federal
bank supervisory authority;
A futures commission merchant or an introducing broker-
commodities; and
A mutual fund.
5. Definition of Covered Transaction
The term ``covered transaction'' means a transaction as defined in
31 CFR 1010.100(bbb)(1) in CVC by, through, or to the covered financial
institution that the covered financial institution knows, suspects, or
has reason to suspect involves CVC mixing within or involving a
jurisdiction outside the United States. The reference to FinCEN's
definition of ``transaction'' means that a covered transaction includes
the following: a purchase, sale, loan, pledge, gift, transfer,
delivery, or other disposition, and with respect to a financial
institution includes a deposit, withdrawal, transfer between accounts,
exchange of currency, loan, extension of credit, purchase or sale of
any stock, bond, certificate of deposit, or other monetary instrument,
security, contract of sale of a commodity for future delivery, option
on any contract of sale of a commodity for future delivery, option on a
commodity, purchase or redemption of any money order, payment or order
for any money remittance or transfer, purchase or redemption of casino
chips or tokens, or other gaming instruments or any other payment,
transfer, or delivery by, through, or to a financial institution, by
whatever means effected. To this end, FinCEN would expect covered
financial institutions to employ a risk-based approach to compliance of
this proposed rule, and more broadly, the Bank Secrecy Act, including
by using the variously available free and paid blockchain analytic
tools commonly available.\76\
---------------------------------------------------------------------------
\76\ FinCEN is not, at this time, proposing that covered
financial instutitons would be required to perform a lookback to
identify covered transactions that occurred prior to issuance of a
final rule.
---------------------------------------------------------------------------
The limitation to transactions ``in CVC'' means that the reporting
obligations under this special measure apply to covered financial
institutions that directly engage with CVC transactions, such as a CVC
exchange. It also means that covered transactions do not include
transactions that are only indirectly related to CVC, such as when a
CVC exchanger sends the non-CVC proceeds of a sale of CVC that was
previously processed through a CVC mixer from the CVC exchanger's bank
account to the bank account of the customer selling CVC.
It is critical that all financial institutions, including those
with visibility into CVC flows, such as CVC exchangers--generally
considered money services businesses (MSBs) under the Bank Secrecy
Act--identify and quickly report suspicious activity, and conduct
appropriate risk-based customer due diligence or, where required,
enhanced due diligence. For example, in appropriately conducting a
review to identify suspicious activity associated with potential
sanctions evasion and to comply with existing FinCEN 311s on Iran and
DPRK, financial institutions must know if transactions originate from
or are destined to prohibited jurisdictions, such as Iran \77\ or
DPRK.\78\ Indeed, FinCEN can, and has, assessed civil monetary
penalties on covered financial institutions that have failed to conduct
such due diligence, including, recently, in enforcement actions against
Bittrex \79\ and BitMex.\80\ In light of the existing compliance
practices of covered financial institutions, FinCEN expects that
complying with this proposed rule should not add a significant
additional burden. FinCEN invites public comment on this assessment.
---------------------------------------------------------------------------
\77\ See FinCEN, Imposition of Fifth Special Measure against the
Islamic Republic of Iran as a Juridiction of Primary Money
Laundering Concern, 84 FR 59302, Nov. 4, 2019, available at https://www.fincen.gov/sites/default/files/shared/2019-23697.pdf.
\78\ See FinCEN 2016 Imposition of Special Measure Against North
Korea.
\79\ See FinCEN, FinCEN Announces $29 million Enforcement Action
Against Virtual Asset Service Provider Bittrex for Willful
Violations of the Bank Secrecy Act, Oct. 11, 2022, available at
https://www.fincen.gov/news/news-releases/fincen-announces-29-million-enforcement-action-against-virtual-asset-service.
\80\ See FinCEN, FinCEN Announces $100 Million Enforcement
Action Against Unregistered Futures Commission Merchant BitMEX for
Willful Violations of the Bank Secrecy Act, Aug. 10, 2021, available
at https://www.fincen.gov/news/news-releases/fincen-announces-100-
million-enforcement-action-against-unregistered-
futures#:~:text=Despite%20BitMEX's%20public%20representation%20that,t
rading%20platform%20and%20circumvent%20internet.
---------------------------------------------------------------------------
B. Reporting and Recordkeeping Requirements
1. Information To Be Reported
Although FinCEN recognizes much of the information that would be
collected under this proposed rule is already provided to the most
frequent reporters in the CVC ecosystem, imposing additional
recordkeeping and reporting requirements is necessary to address the
money laundering threat posed by CVC mixing because, at present,
covered financial institutions do not regularly report when their
customers send or receive CVC in transactions with indicia of CVC
mixing. Reporting that links customers to the CVC mixing transactions
will aid law enforcement and national security investigations of
illicit activity involving CVC. The following addresses the types of
information the rulemaking proposes to collect.
(i) Reportable Information Regarding the Covered Transaction
In connection with all covered transactions, FinCEN proposes to
collect the following information:
The amount of any CVC transferred, in both CVC and its
U.S. dollar equivalent when the transaction was initiated: The amount
of CVC transferred would aid in performing analysis using a risk-based
approach. The proposed rule would require the amount in CVC and U.S.
dollar equivalent when the transaction was initiated to account for
volatile CVC prices and aid in consistent monitoring and risk
management purposes.
CVC type: The proposed rule would require reporting of the
type of CVC used in a covered transaction. The type of CVC used would
allow for trend analysis of preferred usage of different types of CVC,
as well as ensure the correct blockchain analysis can be done given
each CVC exists on different blockchains. Taken together with the
amount of any CVC transferred, this information would inform trend
analysis and allow for an improved understand of laundering typologies.
The CVC mixer used, if known: The proposed rule would
require reporting of the CVC mixer used in the covered transaction.
That information would assist in understanding trends of mixing
activity as well as aid in understanding the quantity of CVC mixers in
the CVC ecosystem.
CVC wallet address associated with the mixer: The proposed
rule would require reporting of the CVC wallet address of the CVC
mixer, if one is used, to aid in understanding of addresses associated
with each CVC mixer. This information would assist with understanding
the size, scale, and methodologies of CVC mixers by facilitating
aggregate analysis of transactional data of CVC mixers.
CVC wallet address associated with the customer: The
proposed rule would require reporting of the CVC wallet address of the
customer to assist in the investigation of the covered transaction,
including blockchain analysis to
[[Page 72711]]
determine if the wallet is associated with illicit activities.
Transaction hash: The proposed rule would require
reporting of the transaction hash, which will allow an investigation of
the specific transaction and assist in the identification of specific
wallet addresses involved in the transaction(s), as well as more
specific transactional meta data such as the date and time the
transaction was completed.
Date of transaction: The proposed rule would require
reporting of the date of transaction, which would assist in enforcing
the proposed regulation, as well as assist in corroborating other
reported information.
IP addresses and time stamps associated with the covered
transaction: The proposed rule would require reporting of the IP
address to obtain geographical information related to the covered
transaction, which would assist trend analysis of patterns of covered
transactions by geographic location.
Narrative: The proposed rule would require a description
of activity observed by the covered financial institution, including a
summary of investigative steps taken, provide additional context of the
behavior, or other such information the covered financial institution
believes would aid follow on investigations of the activity. As the
covered financial institution would have insight into the normal
pattern of its customers' transactions, this narrative would assist
with understanding if there is an uncharacteristic change in pattern of
behavior.
Importantly, under the proposed rule, covered financial
institutions would continue to have an obligation to file a SAR when
warranted, regardless of whether the covered financial institutions
also filed a report required under the proposed rule.
(ii) Reportable Information Regarding the Customer Associated With the
Covered Transaction
In respect of customers associated with covered transactions,
FinCEN proposes to collect the following information:
Customer's full name: The proposed rule would require
reporting of the full name of the covered financial institution's
customer, as it appears in the customer's proof of identification and
related documents, such as passport or driver's license or non-driver
identification card, used by the customer when they validated their
identity with the covered financial institution.
Customer's date of birth: The proposed rule would require
reporting of the full date of birth of the covered financial
institution's customer, as it appears in the customers onboarding file.
Address: The proposed rule would require reporting of the
most appropriate address (residential or business) of the customer
engaged in a covered transaction. Specifically, if the customer is a
business, the business address would be reported, and, if the customer
is an individual, the residential address would be reported.
Email Address associated with any and all accounts from
which or to which the CVC was transferred: The proposed rule would
require email address(es) used by a customer involved in a covered
transaction and known to the covered institution.
Unique identifying number: For individuals, the proposed
rule requires reporting of customers' Internal Revenue Service (IRS)
Taxpayer Identification Number (TIN) or, if the individual does not
have one, a foreign equivalent. If the customer has neither a TIN nor a
foreign equivalent, the proposed rule would require reporting of a non-
expired United States or foreign passport number or other government-
issued photo identification number, such as a driver's license. For
entities, the proposed rule would require reporting of the entity's IRS
TIN or, if the entity does not have one, a foreign equivalent or a
foreign registration number. TINs and other unique identifying numbers
provide law enforcement with the most efficient means to identify
individuals potentially involved in illicit activity.
2. Filing Procedures
The proposed regulation would require a covered financial
institution to collect, maintain records of, and report to FinCEN
within 30 calendar days of initial detection of a covered transaction,
in the manner that FinCEN may prescribe, certain information regarding
covered transactions that involve CVC mixing. This includes certain
information the covered financial institution shall provide with
respect to each covered transaction which is examined in detail below.
This proposed reportable information is similar to the information
already collected by financial institutions to comply with their AML/
CFT obligations; however, at present covered businesses would not
necessarily report such information. Notably, the proposed regulation
only requires a covered financial institution to report information in
its possession, and thus does not require a covered institution to
reach out to the transactional counterparty to collect additional
information on the CVC mixing transaction.
3. Recordkeeping Requirements
Pursuant to the proposed rule, covered financial institutions would
be required to maintain any records documenting compliance with the
requirements of this regulation.
VII. Request for Comments
FinCEN invites comments on all aspects of the proposed rule,
including the following specific matters:
A. CVC Mixing as a Class of Transactions of Primary Money Laundering
Concern
1. What impact would this proposed rule have on legitimate activity
conducted by persons in the course of conducting financial
transactions?
2. What impact would the proposed rule have on blockchain privacy
or pseudonymity, noting that filings reported to FinCEN are not
publicly releasable and the similarities of this proposal to the
recordkeeping and reporting requirements of transactions using the
traditional financial system, such as with wire or Automated Clearing
House (ACH) transactions?
3. Does the impact on privacy and legitimate applications
identified in Section IV.B potentially outweigh the risks posed by
illicit activity facilitated by CVC mixing?
4. What challenges are anticipated with respect to identifying the
foreign nexus of a CVC mixing transaction?
5. Are there any other methods that covered financial institutions
can use to be able to readily determine if covered transactions
stemming from non-mixer CVC mixing have a foreign nexus?
6. Are there sufficient tools available, either free or paid, that
would aid covered financial instutitions to determine if covered
transactions occurred outside the United States?
7. Are there any other methods that covered financial institutions
can use to be able to readily determine if covered transactions
stemming from non-mixer CVC mixing have a foreign nexus?
8. Has FinCEN appropriately weighed the legitimate and illicit
activities associated with the use of CVC mixing? What other factors
should be considered?
B. Definitions
1. Please provide suggested revisions to the proposed definitions
that would better tailor the intended recordkeeping and reporting
obligations to the objectives and uses described in this proposal.
Where possible, please
[[Page 72712]]
provide information or examples to illustrate how the recommended
revisions improve upon the definitions as proposed.
2. Does the proposed definition of CVC mixing adequately capture
the activity of concern? If not, please provide suggested revisions to
the proposed definition that would better capture such activity. Where
possible, please provide information or examples to illustrate how the
recommended revisions would improve upon the definition as proposed.
3. Does the proposed exception to the definition of CVC mixing
adequately account for legitimate activity conducted by VASPs and other
financial institutions? If not, please provide suggested revisions to
the proposed definition that would better capture such activity. Where
possible, please provide information or examples to illustrate how the
recommended revisions would improve upon the definition as proposed.
C. Alternatives
1. Is FinCEN's proposal of enhanced recordkeeping under section
311's special measure one most appropriate to the objectives of this
proposed rule? Where possible, please provide suggestions for
alternative means of achieving the objectives and illustrate how such
means would work in practice.
2. Would section 311's special measures two through five be more
appropriate to apply? If so, please explain why.
D. Recordkeeping and Reporting
1. Is the scope of the recordkeeping requirement appropriate?
2. Is the list of information to be collected and reported
appropriate to address the stated primary money laundering concern?
3. Is the proposed mechanism for submission appropriate for the
purpose of this proposed rule?
4. Are there any alternative methods of submitting reports in an
efficient and effective manner that FinCEN should consider utilizing?
5. Are the proposed reporting and recordkeeping requirements
discussed in Section VI.B.1 and 3 appropriately scoped? Are there
additional types of information regarding reportable transactions or
customers that should be collected?
6. Should the proposed reporting and recordkeeping requirements
apply to covered financial institutions that are the originator
institution, the beneficiary institution, or both?
7. In cases where the customer of a covered financial institution
is a legal entity, should the implementation of special measure one
also require the beneficial ownership of that legal entity be reported,
in addition to the other proposed reporting requirements?
E. Burden and Other Impacts of This Proposed Rule
1. Does FinCEN accurately account for the burden and impact of this
proposed rule when a covered financial institution knows, suspects, or
has reason to suspect a transaction involves CVC mixing?
2. Is there a less burdensome way of collecting information
regarding the details of a CVC transaction, which the BSA's AML/CFT
objectives require financial institutions to collect, including know-
your-customer and customer due diligence?
3. Would the adoption of special measure one reporting and
recordkeeping requirements, as proposed, impose expected costs to
covered financial institutions; state, local, or tribal governments; or
the private sector in excess of $177 million annually? $200 million
annually? Where possible, please provide data or studies from an
identifiable source that would support the response or describe why a
source cannot be identified.
4. To what extent should FinCEN consider the potential costs to
currently unregistered or otherwise non-reporting entities that, if
compliant, would incur costs if special measure one is adopted as
proposed? If possible, please illustrate either quantitatively or
qualitatively (by way of example or anecdote) how the recommended level
of consideration would improve FinCEN's estimate of regulatory impact.
5. Are there any material facts, data, circumstances, or other
considerations that, had they been included in FinCEN's regulatory
impact analysis, would have both improved the precision and accuracy of
the analysis and substantially altered the assessment of the proposed
rule's impact? If so, please provide, including attribution to the
sources of such information, where possible.
6. Would the adoption of special measure one reporting and
recordkeeping requirements, as proposed, impose significant costs on
covered financial institutions that are small entities? On other small
entities that are not covered financial institutions? Where possible,
please provide data or studies from an identifiable source that would
support the response or describe why a source cannot be identified.
7. Are the due diligence requirements appropriately scoped in this
proposed rule?
8. What impact will this proposal have on augmenting law
enforcement's ability to track and trace CVC derived from cyber heists,
ransomware, or similar illicit activity to aid the return of victim's
CVC?
9. Are there any international efforts to address illicit finance
risks stemming from mixing not addressed in the NPRM?
10. What effect would the proposed rule have on international
efforts to address the illicit use of CVC mixing?
11. Are there specific examples of ``covered transactions'' or
sample scenarios that FinCEN could have provided to assist financial
institutions and other affected parties in further understanding the
intended applicability of the proposed definition of ``covered
transactions''? Alternatively, are there other clarifications to the
definitions in this NPRM, or other modifications to the proposed
regulatory text that would meaningfully clarify when a covered
transaction occurs that would warrant reporting? If so, please
describe.
12. Is FinCEN correct in its assessment that covered financial
institutions would have access to reasonable and appropriate services
or tools, whether free or paid, to be able to effectively identify
covered transactions? If not, what are impediments to accessing such
tools, and what costs would be associated with gaining access?
13. To what extent could public guidance or other informational
materials regarding compliance with the requirements of proposed
special measure one (such as FAQs, pre-recorded instructional audio-
visual resources, or in-person presentations with industry groups)
meaningfully reduce costs to covered financial institutions? Please
describe any preferred method(s), as well as any qualitative or
quantitive estimates of the extent to which costs are expected to be
reduced.
VIII. Regulatory Impact Analysis
FinCEN has analyzed this proposed rule under Executive Orders
12866, 13563, and 14094, the Regulatory Flexibility Act,\81\ the
Unfunded Mandates Reform Act,\82\ and the Paperwork Reduction Act.\83\
---------------------------------------------------------------------------
\81\ 5 U.S.C. 603.
\82\ 12 U.S.C. 1532, Public Law 104-4 (Mar. 22, 1995).
\83\ 44 U.S.C. 3507(a)(1)(D).
---------------------------------------------------------------------------
[[Page 72713]]
As discussed above,\84\ the intended effects of the imposition of
special measure one to CVC mixing are twofold. The rule is expected to:
(1) facilitate the investigation and prosecution of illicit activities
by parties using CVC mixing in furtherance of their unlawful objectives
\85\ and, in many cases,\86\ consequent private enrichment; and (2)
disincentivize the use of CVC mixing in connection with money
laundering and other financial crimes by reducing the likelihood that
such CVC mixing will adequately insulate the underlying transactions
from identification and traceability.\87\ In the analysis below, FinCEN
discusses the economic effects that are expected to accompany adoption
of the rule as proposed and assess such expectations in more granular
detail. This discussion includes a detailed explanation of certain ways
FinCEN's conclusions may be sensitive to methodological choices and
underlying assumptions made in drawing inferences from available data.
Throughout, these have been outlined so that the public may review and
provide comment.\88\
---------------------------------------------------------------------------
\84\ See, specifically discussion supra Section IV. C. See
generally discussion supra Section II.
\85\ See, e.g., discussion of Axie Infinity heist supra Section
III.B.
\86\ See, e.g., discussion of use in connection with darknet
market transactions and laundering the proceeds of ransomware
attacks supra Sections III.B and IV.A.
\87\ See discussion supra Section IV.C.
\88\ See Section VII.E.
---------------------------------------------------------------------------
A. Assessment of Impact
By requiring covered financial institutions to implement special
measure one, the proposed rule would impose additional obligations on
these institutions to report transactions that they know, suspect, or
have reason to suspect involve CVC mixing because FinCEN has determined
that CVC mixing, as a class of transactions, is of primary money
laundering concern.
The imposition of this special measure may require a shift in
reporting practices, particularly with regard to the determination a
covered financial institution would otherwise first need to make: that
a transaction involving CVC mixing is suspicious and therefore
reportable under the applicable SAR Rule.\89\ The reporting and
recordkeeping requirements under special measure one would instead
guide a covered financial institution to presume transactions that
involve CVC mixing are inherently of primary money laundering concern.
Therefore, under this proposal, the implied burden would shift from
determining when a CVC transaction is reportable to determining when it
is not reportable.
---------------------------------------------------------------------------
\89\ See, e.g., FinCEN 2019 CVC Guidance supra note 16 and
FinCEN, Reporting Suspicious Activity A Quick Reference Guide for
Money Services Businesses, September, 2007, available at https://www.fincen.gov/sites/default/files/shared/report_reference.pdf.
---------------------------------------------------------------------------
FinCEN has considered the regulatory impact of the proposed rule
and the economic consequences these changes would entail. The
subsequent analysis details FinCEN's finding that, in proportion to the
thousands of covered financial institutions subject to FinCEN's general
reporting and recordkeeping requirements, relatively few are exposed to
CVC mixing and, additionally, proportionally few transactions per
exposed financial institution covered under the proposed rule are
likely to trigger the new recordkeeping and reporting requirements, of
which fewer still may provide actionable information. However, any one
reportable transaction, by nature of the underlying illicit and
potentially dangerous activity it facilitates, could provide large
benefits to FinCEN and law enforcement if identified, or, alternatively
framed, could impose substantial costs and serious national security
risks if unreported.\90\
---------------------------------------------------------------------------
\90\ See, e.g., discussion supra Sections III.B and IV.A.
---------------------------------------------------------------------------
1. Broad Economic Considerations
At present, in the absence of an obligation to comply with special
measure one requirements, a covered financial institution may determine
that a financial transaction exposed, directly \91\ or indirectly,\92\
to CVC mixing bears indicia of illicit activity. Given the potential
link to illicit activity, this financial institution might file a SAR
in compliance with existing BSA requirements. However, there are a
number of potential reasons why any one individual institution may not
file such a report, including that in terms of economic fundamentals,
such reporting may not be privately optimal. Consequently, the absence
of the proposed special measure one reporting requirement might
naturally result in systematic underreporting of CVC mixing-related
suspicious activity, particularly when the exposure to CVC mixing does
not involve a CVC mixer. As discussed above, preliminary evidence
suggests that this underreporting occurs.\93\
---------------------------------------------------------------------------
\91\ See infra note 121.
\92\ See infra note 122.
\93\ See discussion supra Section IV.A.3.
---------------------------------------------------------------------------
In terms of economic fundamentals, reporting on transactions
exposed to CVC mixing produces a positive externality insofar as the
reporting entity incurs expenses in connection with such reporting that
are not directly, fully compensated. As such, the marginal social
benefit of reporting exceeds the private costs. Consequently, in the
absence of imposing a social (compliance-related) cost to non-
reporting, the entity-specific equilibrium level of reporting will
always be less than the social optimum. Furthermore, from a
microeconomic- or a more industrial-organization-level of analysis,
there are competitive reasons why, absent a uniform reporting
requirement, no single covered financial institution that knows,
suspects, or has reason to suspect CVC mixing would benefit from
competing lower on the perceived level of quality in privacy. In such a
setting, achieving the socially optimal level of reporting would again
be unobtainable in the absence of a policy intervention (such as the
proposed reporting and recordkeeping requirements).
In this proposal, FinCEN is mindful that certain unintended,
responsive changes in behavior may reduce the efficacy of this rule or
otherwise attenuate the intended net benefits by limiting the scope of
benefits or by increasing the costs of compliance. Additionally, the
attendant costs and benefits per reported transaction may not be
uniformly distributed across the affected covered financial
institutions. There may also be broader programmatic costs or
repercussions to: (1) the specific framing of CVC mixing and CVC mixers
as proposed; \94\ (2) the framing of CVC mixing activity as
categorically foreign-state-operated, -located, or otherwise -adjacent;
(3) the reporting and recordkeeping requirements being applicable to
domestic financial institutions only; and (4) allowing an in-the-
course-of-business exemption to covered financial institutions, that
each remain unquantified in the following impact analysis.
Nevertheless, FinCEN has made a studied \95\ and advised \96\
determination that these considerations are outweighed by the primary
money laundering concern that animates this proposal and are therefore
not further incorporated in the subsequent discussion.
---------------------------------------------------------------------------
\94\ See invitation for public comment on potential costs and
repercussions supra Section VII.B.
\95\ 31 U.S.C. 5318A(a)(4)(B). See discussion supra Section I.
\96\ See discussion of 31 U.S.C. 5318A(c)(1) requirements supra
Section I. See also discussion of 31 U.S.C. 5318A(a)(4)(A) supra
Sections I and V.
---------------------------------------------------------------------------
[[Page 72714]]
2. Institutional Baseline and Affected Parties
In proposing this rule, FinCEN considered the incremental impacts
of imposing special measure one relative to the current state of the
affected markets and their participants. This baseline analysis of the
parties that would be affected by the proposed rule, their current
obligations, and common activities satisfies certain analytical best
practices \97\ by detailing the implied alternative of not pursuing the
proposed, or any other, regulatory action. This baseline also forms the
counterfactual against which the quantifiable effects of the rule are
measured; therefore, substantive errors in or omissions of relevant
data, facts, or other information may affect the conclusions formed
regarding the general and/or economically significant impacts of the
rule. Additionally, because it is unclear that the imposition of
special measure one would, independently, alter the registration and
compliance choices already made by such affected parties, quantitative
portions of the subsequent analysis have not attempted to estimate the
number of, or magnitude of effects on, unregistered or otherwise non-
compliant entities that FinCEN qualitatively might expect to be
affected by the rule. Because both these considerations may have first-
order effects on the expected magnitude of certain outcomes, the public
is invited to provide further insights or information--particularly,
data or quantitative studies--that could contribute to a more precise
or more accurate estimation of impact.\98\
---------------------------------------------------------------------------
\97\ See specifically E.O. 12866 Section 1(a) (``In deciding
whether and how to regulate, agencies should assess all costs and
benefits of available regulatory alternatives, including the
alternative of not regulating.'').
\98\ See, e.g., supra Section VII.E.
---------------------------------------------------------------------------
(i) Baseline of Affected Parties
(A) Covered Financial Institutions
The parties expected to comply with the special measure one include
any and all domestic covered financial institutions as defined in 31
CFR 1010.100(t).\99\ Table 1 (below) reports an annual maximum of
potentially affected entities based on FinCEN's most recent estimates
of the total number of entities that meet the respective regulatory
definitions.\100\ Estimates of potentially affected money services
businesses by subcategories as defined in 31 CFR 1010.100(ff) are
intended to aid in subsequent discussion, which details our assumptions
about differences in expected compliance burdens by group. Estimates in
parentheses reflect the total number of registered money services
businesses that self-identified their business by the given service
subcategory as defined in 31 CFR 1010.100(ff), among others.\101\ Money
services business subcategory estimates outside parentheses represent
the number of entities that self-identified as registering (and
reporting) singularly due to the requirements for that subcategory.
---------------------------------------------------------------------------
\99\ See discussion supra Section VI.A.4; see also proposed
amendment 31 CFR 1010.662(a)(4) infra Section IX.
\100\ Numbers presented here may differ slightly from those
presented in other, concurrent agency rulemaking because estimates
in this analysis are rounded to the nearest ten for ease of
aggregation. Such differences are not expected to be economically
meaningful.
\101\ For the full list of non-exclusive subcategories a money
services business may use to self-identify when submitting a
registration see msb.fincen.gov/definitions/msbKey.php.
Table 1--Estimates of Affected Financial Institutions by Type
------------------------------------------------------------------------
Number of
Financial institution type \a\ entities
------------------------------------------------------------------------
Bank \b\.............................................. \c\ 9,850
Broker/Dealer in Securities \d\....................... \e\ 3,540
Money Services Business \f\........................... \g\ 25,710
Dealer in Foreign Exchange \h\........................ \i\ 190 (3,000)
Check Casher \j\...................................... \k\ 5,960
(21,970)
Issuer/Seller of Traveler's Checks/Money Orders \l\... \m\ 380
Provider of Prepaid Access \n\........................ \o\ 20 (130)
Seller of Prepaid Access \p\.......................... \q\ 40 (2,220)
U.S. Postal Service \r\............................... \s\ 0
Money Transmitter \t\................................. \u\ 450 (16,460)
Telegraph Company \v\................................. \w\ 0
Casino \x\............................................ \y\ 990
Card Club \z\......................................... \aa\ 270
Person subject to supervision by any State or Federal \cc\ N/A
Bank Supervisory Authority \bb\......................
Futures Commission Merchant \dd\...................... \ee\ 60
Introducing Broker in Commodities \ff\................ \gg\ 970
Mutual Fund \hh\...................................... \ii\ 1,380
------------------------------------------------------------------------
\a\ As typographically grouped in 31 CFR X 1010.100(t) and (ff),
respectively.
\b\ See 31 CFR 1010.100(t)(1); see also 31 CFR 1010.100(d).
\c\ Counts of certain types of banks, savings associations, thrifts, and
trust companies are from Q1 2023 Federal Financial Institutions
Examination Council (FFIEC) Call Report data, available at https://cdr.ffiec.gov/public/pws/downloadbulkdata.aspx. Data for institutions
that are not insured, are insured under non-FDIC deposit insurance
regimes, or do not have a Federal functional regulator are from the
FDIC's Research Information System, available at https://www.fdic.gov/foia/ris/index.html. Credit union data are from the NCUA for Q1 2023,
available at https://www.ncua.gov/analysis/credit-union-corporate-call-report-data.
\d\ 31 CFR 1010.100(t)(2).
\e\ According to the SEC, the number of brokers or dealers in securities
for the fiscal year 2022 is 3,538. See Securities and Exchange
Commission, Fiscal Year 2024 Congressional Budget Justification, p.
32, available at https://www.sec.gov/files/fy-2024-congressional-budget-justification_final-3-10.pdf.
\f\ 31 CFR 1010.100(t)(3).
\g\ From FinCEN's publicly available MSB data (https://www.fincen.gov/msb-registrant-search) as of September 1, 2023.
\h\ 31 CFR 1010.100(ff)(1).
\i\ Value in parentheses reflects all entries in data downloaded from
https://www.fincen.gov/msb-registrant-search on August 1, 2023,
including MSB Activities key 415. Alternative value reflects entries
with exclusively key 415.
\j\ 31 CFR 1010.100(ff)(2).
\k\ Value in parentheses reflects all entries in data downloaded from
https://www.fincen.gov/msb-registrant-search on August 1, 2023,
including MSB Activities key 408. Alternative value reflects entries
with exclusively key 408.
[[Page 72715]]
\l\ 31 CFR 10101.100(ff)(3).
\m\ Value reflects all entries in data downloaded from https://www.fincen.gov/msb-registrant-search on August 1, 2023 with,
exclusively, one of the MSB Activities keys 401 (Issuer of traveler's
checks), 402 (Seller of traveler's checks), 404 (Issuer of money
orders), or 405(Seller of money orders). Because of the numerous (134)
alternative combinations of at least one of the 4 keys with at least
one of the other three keys and, in some cases, other keys as self-
reported by registrants, no suitable alternative combination of key
values could be determined as most appropriately and uniquely
representative in light of concerns about multiplicative counting of
affected parties. FinCEN estimates therefore default to the upper
bound of all MSB registrants for this category of parties collectively
incurring a regulatory compliance burden.
\n\ 31 CFR 1010.100(ff)(7)(i)-(ii).
\o\ Value in parentheses reflects all entries in data downloaded from
https://www.fincen.gov/msb-registrant-search on August 1, 2023
including MSB Activities key 414(Provider of prepaid access).
Alternative value reflects entries with exclusively key 414.
\p\ 31 CFR 1010.100(ff)(4)(i)-(iii).
\q\ Value in parentheses reflects all entries in data downloaded from
https://www.fincen.gov/msb-registrant-search including MSB Activities
key 413. Alternative value reflects entries with exclusively key 413.
\r\ 31 CFR 1010.100(ff)(6).
\s\ FinCEN does not expect the U.S. Postal Service, as defined in 31 CFR
1010.100(ff)(6) to incur any recordkeeping or reporting obligations in
connection with this rule.
\t\ 31 CFR 1010.100(ff)(5).
\u\ Value in parentheses reflects all entries in data downloaded from
https://www.fincen.gov/msb-registrant-search including MSB Activities
key 409. Alternative value reflects entries with exclusively key 409.
\v\ 31 CFR 1010.100(t)(4).
\w\ As an estimate of uniquely registered, potentially affected
entities, FinCEN expects this category to contain no additional
persons or organizations not already included in other counts,
particularly as money transmitters.
\x\ 31 CFR 1010.100(t)(5)(i)-(iii).
\y\ According to the American Gaming Association (AGA), there are 468
commercial casinos and 523 tribal casinos as of Dec. 31, 2022. See
American Gaming Association, State of the States: annual report, May
2023, available at https://www.americangaming.org/wp-content/uploads/2023/05/AGA-State-of-the-States-2023.pdf p. 16.
\z\ 31 CFR 1010.100(t)(6)(i)-(ii).
\aa\ According to the American Gaming Association (AGA), there are 266
card rooms as of Dec. 31, 2022.
\bb\ 31 CFR 1010.100(t)(7).
\cc\ It is unclear to FinCEN at this time whether any entities exist in
this category that for purposes of being counted towards unique
affected parties incurring burdens associated with the rule, if
adopted as proposed, are not already captured by concurrent status in
another category of financial institution under the 31 CFR 1010.100(t)
definition. To the extent that additional data can better inform this
estimate, public comment is invited.
\dd\ 31 CFR 1010.100(t)(8).
\ee\ There are 60 futures commission merchants as of June 30, 2023,
according to the CFTC website. See Commodity Futures Trading
Commission, Financial Data for FCMs, available at https://www.cftc.gov/MarketReports/financialfcmdata/index.htm.
\ff\ 31 CFR 1010.100(t)(9).
\gg\ According to CFTC, there are 969 introducing brokers in commodities
as of April 30, 2023.
\hh\ 31 CFR 1010.100(t)(10).
\ii\ According to the SEC, as of December 2022 (including filings made
through Jan 20, 2023) there are 1,378 open-end registered investment
companies that report on Form N-CEN.
Based on these estimates, it is possible that up to approximately
42,800 covered financial institutions could incur new recordkeeping and
reporting costs in complying with special measure one. However, the
extent to which any of these institutions is expected to be
economically impacted is limited insofar as they would need to engage
in transactions \102\ that involve CVC, and thereby the possibility of
CVC mixing. This prerequisite \103\ (that a transaction be in CVC) is
expected to preclude many entities from experiencing any significant
economic effects from the rule.\104\ For example, FinCEN does not
anticipate any direct effects to the U.S. Postal Service or to any
registered telegraph company. Further, FinCEN analysis of public and
non-public sources of information suggests that, categorically,
domestic mutual funds, casinos, and card clubs have low exposure to CVC
transactions. For the same reasons, money services businesses that
provide services exclusively in one or more of the following
subcategories are not expected to experience any substantial change to
compliance burdens: dealer in foreign exchange, check casher, issuer/
seller of traveler's checks or money orders, provider of prepaid
access, and seller of prepaid access. Thus, FinCEN expects
approximately 9,300 fewer than the total estimate of potentially
affected entities to reasonably anticipate any noticeable effect.
---------------------------------------------------------------------------
\102\ 31 CFR 1010.100(bbb)(1).
\103\ See discussion supra Section VI.A.5; see also proposed
amendment 31 CFR 1010.662(a)(5) infra Section IX.
\104\ See discussion of expected economic effects on covered
financial institutions infra Section VIII.A.4.
---------------------------------------------------------------------------
On the other hand, the categories of affected parties that include
the largest proportion of VASPs are expected to face the highest levels
of potential exposure to CVC mixing. These entities are most
concentrated in the money transmitter subcategory of money services
businesses and futures commission merchants. In each case, these VASPs
are a proper subset of their respective groups, and while they are
expected to be the most directly affected by the rule because they have
the highest exposure, the incremental burden of the rule is expected to
be lowest for these entities because it imposes the least adaptation
from current compliance practices and processes.
The covered financial institutions that are expected to face the
greatest incremental burden as a consequence of the proposed
recordkeeping and reporting requirements would be those with both
higher likelihoods of being exposed to CVC mixing and lower tailoring
of existing compliance programs because, for instance, virtual asset
service provision has not historically been integral to the entity's
core business function or model. FinCEN expects that this may
characterize certain banks, or persons subject to supervision by a
state or federal bank supervisory authority, broker/dealers, and
introducing brokers in commodities. However, as these types of
financial institutions are already heavily regulated and typically
already feature robust monitoring and compliance programs, even as they
may face the largest incremental burden, this economic impact might
still be low.\105\
---------------------------------------------------------------------------
\105\ FinCEN is requesting comment on the reasonable bases for
this expectation. See requests for comment supra Section VII.A and
Section VII.E.
---------------------------------------------------------------------------
(B) CVC Mixing Service Providers \106\
---------------------------------------------------------------------------
\106\ In this section, FinCEN uses the term `CVC mixer' as used
in common parlance, noting this may commonly be understood to refer
to only a proper subset of the entities/parties that would meet the
definition of `CVC mixer' as defined in this proposed rule. See
discussion supra Section VII.A.3; see also proposed amendment 31 CFR
1010.662(a)(2) infra Section IX.
---------------------------------------------------------------------------
While the proposed application of special measure one does not
expressly
[[Page 72716]]
impose requirements on CVC mixers that are not covered financial
institutions or those able to rely on the proposed exemption,\107\ it
is reasonable to expect that the relative attractiveness of engaging
with CVC mixers or the number of those who avail themselves of CVC
mixing services might be affected. As a baseline matter of market
structure, the centralized mixing services industry is expected to be
characterized by large network externalities: the value of a CVC mixer
should increase as the number of users increases, because the greater
the number of parties that use a particular CVC mixer, the easier it
becomes for the mixer to anonymize each participant in a mixing
transaction. This characterization is consistent with observable market
behavior. Because network externalities generally reinforce high levels
of market concentration, it may be reasonable to expect that the number
of CVC mixers that can concurrently achieve and maintain a sustainable
scale to continue operations is unlikely to grow. It may also imply
that, to the extent that the demand for CVC mixing services remains
relatively constant over time, in the event that any one CVC mixing
service provider ceases to remain active, another active or new CVC
mixer could greatly benefit from the subsequent increase in demand for
its services.
---------------------------------------------------------------------------
\107\ At the time of this proposal, FinCEN observes no CVC
mixers that meet either or both of these criteria.
---------------------------------------------------------------------------
(C) Clients of Primary Affected Parties
In the course of compliance with special measure one, covered
financial institutions may be required to submit reports and retain
records containing certain unique identifiers \108\ and other personal
information \109\ of a party, or parties, to a CVC mixing-exposed
transaction.\110\ Based on a recent report,\111\ this could affect more
than 300 million users of unhosted CVC wallets insofar as a user's
personal information may be reported if their wallet is deemed by a
covered financial institution to be involved in a covered transaction.
Because there is no restriction on the number of wallets an individual
may have, this number may overestimate the number of unique individuals
whose personal information may be required. To the extent that
previously reported estimates \112\ regarding the distribution of CVC
mixer users by type--privacy-oriented versus abusers of anonymity--are
usable for inference, special measure one could require the reporting
of personal information in connection with up to approximately 66 (87)
percent of CVC mixer deposits in the absence of any other identifiable
connection to high risk (illicit) activity.
---------------------------------------------------------------------------
\108\ Including name (see proposed amendment 31 CFR
1010.662(b)(1)(ii)(A) infra Section IX) and government issued
(alpha)numeric identifier (see proposed amendment 31 CFR
1010.662(b)(1)(ii)(F) infra Section IX); see also discussion supra
Section VI.
\109\ Including a customer's CVC wallet address (see proposed
amendment 31 CFR 1010.662(b)(1)(i)(E) infra Section IX), date of
birth (see proposed amendment 31 CFR 1010.662(b)(1)(ii)(B) infra
Section IX), address (see proposed amendment 31 CFR
1010.662(b)(1)(ii)(C) infra Section IX), and email address (see
proposed amendment 31 CFR 1010.662(b)(1)(ii)(D) infra Section IX);
see also discussion supra Section VI.
\110\ See Section VI.B.1.
\111\ Chainalysis Report, On-Chain User Segmentation for Crypto
Exchanges, June 22, 2023, available at https://www.chainalysis.com/blog/crypto-exchanges-on-chain-user-segmentation-guide/.
\112\ See discussion supra Section IV.A.3; see also supra note
58.
---------------------------------------------------------------------------
FinCEN has weighed these considerations against the broader
economic concern of systematic underreporting in the absence of special
measure one requirements,\113\ and concluded that the associated costs
to privacy-oriented clients of covered financial institutions and CVC
mixers are small in both relative \114\ and absolute \115\ terms.
Further, there is no reason to believe the required records and
personal information contained therein would be subject to any greater
risk of improper access, use, or exposure than any other record or
report filed with a federal agency or maintained by a covered financial
institution.
---------------------------------------------------------------------------
\113\ See discussion supra Section IV.A.3; see also Section
VIII.A.1.
\114\ FinCEN considered costs here proportionally to the value
of the information collected and reported in connection with illicit
finance-related transactions. See discussion supra Section VIII.A;
see also supra note 90.
\115\ FinCEN considered here the aggregate potential
informational exposure, which depends jointly on (1) the quanta of
personal information collected and reported and (2) the expected
number of instances in which access to that personal information is
granted in the course of a legitimate investigative or prosecutorial
activity.
---------------------------------------------------------------------------
(D) Other Affected Parties
FinCEN further anticipates second order economic effects of the
proposed rule on parties ancillary to transactions between covered
financial institutions, CVC mixing service providers, and clients of
either or both, such as counsel, advisors, external forensic firms,
independent auditors, IT services, and other compliance facilitators or
third-party service providers. In particular, FinCEN expects the
proposed requirements may affect the demand for services by third party
blockchain analytics companies.\116\ Such companies provide transaction
screening and risk rating services to financial institutions that may
hire them in lieu of, or to complement, similar functions performed in-
house. Because of the specialized experience and expertise required to
build a program, reporting in near real time, that not only monitors
multiple blockchains, but also incorporates a multitude of additional
data sources to enrich a given blockchain's transaction- and
transaction party-related information, few such companies exist and the
market is consequently concentrated to fewer than ten main entities.
---------------------------------------------------------------------------
\116\ At present, it is unclear to FinCEN whether, in light of
the proposed requirements, a covered financial institution would be
more likely to treat these third party services as a substitute or a
complement to in-house screening and risk-management activities.
Therefore while there is an expected change to demand for these
third party services, the direction of this change remains unsigned.
---------------------------------------------------------------------------
Separately, because the proposed rule is limited in scope to only
the mixing of CVC, to the extent that digital token mixing and its
service providers are considered viable substitutes for CVC mixing or
could otherwise be employed to obfuscate CVC mixing, the demand for
token mixing and its service providers may increase as a consequence of
adopting the rule as proposed.
(ii) Regulatory and Market Baseline
(A) Current Requirements
The ten categories of financial institutions covered by the
proposed rule, as defined in 31 CFR 1010.100(t) are expected to already
be compliant with the required activities as outlined in 31 CFR 1020
(Banks), 1021 (Casinos and Card Clubs), 1022 (Money Service
Businesses), 1023 (Brokers or Dealers in Securities), 1024 (Mutual
Funds), and 1026 (Futures Commission Merchants and Introducing Brokers
in Commodities), as applicable. These rules include requirements for
financial institutions to: (1) create and maintain compliance policies,
procedures, and internal controls; (2) engage in customer
identification verification; (3) file reports with FinCEN; (4) create
and retain records; and (5) respond to law enforcement requests, and
have guided financial institutions' understanding of FinCEN's
expectations of compliant reporting and recordkeeping activity since
before the advent of virtual currency. Where the original rules are
silent on the application of, or compliance with, these requirements
with respect to CVC, FinCEN and OFAC
[[Page 72717]]
have historically provided successive, iterative guidance \117\ and
other information \118\ that clarifies expectations with respect to
required practices. Furthermore, FinCEN has historically issued
advisories and press releases based on FATF guidance to financial
institutions,\119\ including VASPs, concerning processes and legal
obligations that apply to transactions involving high risk and
sanctioned juridictions.
---------------------------------------------------------------------------
\117\ See FIN-2013-G001, Application of FinCEN's Regulations to
Persons Administering, Exchanging, or Using Virtual Currencies, Mar.
18, 2013, available at https://www.fincen.gov/sites/default/files/guidance/FIN-2013-G001.pdf (2013 Guidance); see also FinCEN 2019 CVC
Guidance.
\118\ See generally OFAC, Questions on Virtual Currency,
available at https://ofac.treasury.gov/faqs/topic/1626; see,
specifically OFAC, Sanctions Compliance Guidance for the Virtual
Currency Industry, Oct. 2021, available at https://ofac.treasury.gov/media/913571/download?inline.
\119\ See, e.g., FinCEN, Financial Action Task Force Identifies
Jurisdictions with Anti-Money Laundering and Combating the Financing
of Terrorism and Counter-Proliferation Deficiencies, June 29, 2023,
available at https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-and-4; FIN-2021-A003 ``Advisory on the Financial Action Task Force-
Identified Jursdictions with Anti-Money Laundering and Combating the
Financing of Terrorism and Counter-Proliferations Deficiencies''
available at https://www.fincen.gov/sites/default/files/advisory/2021-03-11/FATF%20February%202021%20Advisory%20FINAL%20508.pdf.
---------------------------------------------------------------------------
Preliminarily, evidence suggests that at least some covered
financial institutions have long anticipated and appreciated the
applicability of SAR and currency transaction reporting requirements to
transactions involving CVC: the first SAR including language specific
to a CVC was filed thirteen years ago in 2010, predating FinCEN's 2013
Guidance, and the first SAR filed by a VASP, approximately two months
after the 2013 Guidance was issued, is already a decade old. Since the
issuance of that guidance, FinCEN has received CVC-related SARs from
approximately 4,500 distinct filers. As such, the reporting and
recordkeeping requirements that would be introduced by the proposed
rule may build incrementally onto an existing regulatory compliance
framework, inclusive of CVC, that is well understood, and where a
nontrivial proportion of covered financial institutions demonstrate
willingness and ability to meet existing reporting and recordkeeping
obligations.
(B) Current Market Practices
When assessing relevant baseline elements of current market
practice against which to forecast the regulatory and economic impacts
of special measure one requirements as proposed, FinCEN--in addition to
the current regulatory requirements--also considered certain factors of
current practices including: (1) the extent to which covered financial
institutions are identifiably exposed to CVC mixing; and (2) the
availability of reliable tools and methods with which to detect the
kinds of CVC mixing exposure that would trigger the proposed reporting
and recordkeeping requirements.
As a component of this analysis, FinCEN conducted an independent
historical review of CVC mixing exposure occurring in the ordinary
course of business at the largest registered CVC exchanges from their
respective first trade dates until present.\120\ As these are some of
the affected covered financial institutions with highest expected
exposure to CVC mixing, their relative volumes of CVC mixing-exposed
transactions is likely to present a reasonable upper-bound on the
proportion of currently identifiable transactions that could incur
additional record-keeping and reporting requirements in connection with
the imposition of the first special measure. This study found that
during the period reviewed, mean (median) daily transaction volume with
observable direct exposure \121\ was approximately 0.010 percent (0.009
percent), while mean (median) observable indirect exposure \122\ was
approximately 0.234 percent (0.168 percent) of daily transaction
volume. The analysis yielded comparable results when proportions were
based on share of total transactions instead of U.S. Dollar value
equivalent. It would therefore appear that, to the extent that future
CVC mixing exposure is consistent with past and current trends, the
number of transactions that would require reporting and recordkeeping
as a unique consequence of adopting special measure one as proposed is
extremely low in relative terms.
---------------------------------------------------------------------------
\120\ This study incorporated both public and non-public data as
well as certain proprietary and non-proprietary computer programs to
analyze transactions occurring between calendar year 2010 at the
earliest (given that each exchange has a unique start date) and the
date the study was concluded (August 3, 2023).
\121\ Direct exposure refers to transactions where CVC is sent
from one CVC wallet address to another CVC wallet address, without
the use of an intermediary. For example, if a VASP received funds
from--or sent funds to--a CVC mixer without first going through an
intermediary, that VASP has direct exposure to CVC mixing.
\122\ Indirect exposure refers to transactions where CVC is sent
from a CVC wallet address through at least one other wallet address
to arrive at the intended recipient. For example, if CVC was sent
from a CVC mixer to a CVC wallet address and then to a VASP, that
VASP has indirect exposure to CVC mixing. Similarly, if CVC sent
from a VASP to a CVC wallet address was subsequently send to a CVC
mixer, it would be indirectly exposed to CVC mixing.
---------------------------------------------------------------------------
FinCEN also reviewed the availability of tools, other than the use
of third party blockchain analytics companies, that a financial
institution currently has the option to employ to detect exposure to
CVC mixing transactions in the course of complying with existing SAR
and/or CTR related requirements. CVC mixing exposure can occur
(directly \123\ or indirectly \124\) in the process of sending CVC to,
or receiving CVC from, a covered financial institution (such as a CVC
exchange) and can be detected via a range of free and paid commercial
software programs.\125\ Free programs, such as common block explorers,
can easily reveal direct \126\ exposure to a CVC mixer if the CVC mixer
infrastructure is relatively stable and well known, such as in the case
of many Ethereum-based CVC mixers. Indirect \127\ exposure may be also
discoverable using these programs but might require supplementary
manual investigative work to uncover. Paid commercial programs employ
suites of heuristics to more comprehensively identify CVC mixers, and
market themselves on their ability to automatically detect bi-
directional indirect \128\ and direct \129\ exposure to CVC mixing
activity for any blockchain address supported by the service. On
blockchains supporting native smart contract capability, these
automated attribution capabilities can be easily defeated if a user
routes funds through token contracts or other digital asset entities
providing on-chain exchange services. In such cases, analysts can still
perform manual blockchain forensic tracing to identify the origin of
funds.
---------------------------------------------------------------------------
\123\ See definition supra note 121.
\124\ See definition supra note 122.
\125\ FinCEN notes that the extent to which exclusive use of any
of these tools (free or commercial software programs) would fully
satisfy either existing reporting and recordkeeping requirements, or
those imposed by the proposed special measure one, is a matter of
facts and circumstances.
\126\ Id. at note 121.
\127\ Id. at note 122.
\128\ Id. at 122.
\129\ Id. ar 121.
---------------------------------------------------------------------------
3. Description of the Proposed Reporting and Recordkeeping Requirements
of the First Special Measure
Imposing special measure one as proposed would introduce novel but,
in many cases, incrementally modest additional recordkeeping and
reporting obligations, requiring the collection and transmission of
certain information in its possession when a covered financial
institution knows, suspects, or has reason to suspect a transaction
occurred
[[Page 72718]]
that involved the use of CVC mixing within or involving a jurisdiction
outside the United States.\130\ The affected institution at which a
covered transaction is conducted or attempted would need to collect
required information about the covered transaction and, within 30 days
of initial detection of a covered transaction, provide a report to
FinCEN containing as much of the reportable required information as
available to the affected institution--via electronic filing or other
agency-prescribed manner.\131\
---------------------------------------------------------------------------
\130\ See Section VI. See also Section IX.
\131\ See discussion supra Section VI.B.2; see also proposed
amendment 31 CFR 1010.662(b)(2) infra Section IX.
---------------------------------------------------------------------------
Additionally, for a specified period of time (five years \132\)
after filing its report, each covered financial institution would
engage in new recordkeeping activities because it would need to
document its compliance with the filing procedures and the reporting
requirements by: (1) maintaining a copy of any records related to CVC
mixing transactions they have filed; and (2) obtaining and recording
copies of documentation relating to compliance with the
regulation.\133\
---------------------------------------------------------------------------
\132\ 31 CFR 1010.430
\133\ See discussion supra Section VI.B.3; see also proposed
amendment 31 CFR 1010.662(b)(3) infra Section IX.
---------------------------------------------------------------------------
The required information would identify and describe certain unique
features and characteristics of both the reportable covered transaction
and the customer associated with the covered transaction. The required
informational components concerning the covered transaction pertain to
the CVC when transferred (currency type,\134\ amount,\135\ and U.S.-
dollar equivalent \136\), the CVC mixer (identity \137\ and/or wallet
address \138\), and the transaction (hash,\139\ date,\140\ IP addresses
and timestamps,\141\ and narrative description \142\), while the
required informational components concerning the associated customer
include name \143\, date of birth \144\, addresses (physical,\145\ CVC
wallet,\146\ and associated email \147\), phone number,\148\ and an
entity-specific government-issued (alpha)numeric identifier.\149\
---------------------------------------------------------------------------
\134\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(B) infra Section IX.
\135\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(A) infra Section IX.
\136\ Id.
\137\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(C) infra Section IX.
\138\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(D) infra Section IX.
\139\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(F) infra Section IX.
\140\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(G) infra Section IX.
\141\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(H) infra Section IX.
\142\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(I) infra Section IX.
\143\ See discussion supra Section VI.B.1(ii); see also proposed
amendment 31 CFR 1010.662(b)(1)(ii)(A) infra Section IX.
\144\ See discussion supra Section VI.B.1(ii); see also proposed
amendment 31 CFR 1010.662(b)(1)(ii)(B) infra Section IX.
\145\ See discussion supra Section VI.B.1(ii); see also proposed
amendment 31 CFR 1010.662(b)(1)(ii)(C) infra Section IX.
\146\ See discussion supra Section VI.B.1(i); see also proposed
amendment 31 CFR 1010.662(b)(1)(i)(E) infra Section IX.
\147\ See discussion supra Section VI.B.1(ii); see also proposed
amendment 31 CFR 1010.662(b)(1)(ii)(D) infra Section IX.
\148\ See discussion supra Section VI.B.1(ii); see also proposed
amendment 31 CFR 1010.662(b)(1)(ii)(E) infra Section IX.
\149\ See discussion supra Section VI.B.1(ii); see also proposed
amendment 31 CFR 1010.662(b)(1)(ii)(F) infra Section IX.
---------------------------------------------------------------------------
4. Expected Economic Effects on Covered Financial Institutions
As discussed above, the parties expected to incur an economic
burden as they comply with the first special measure include all
financial institutions as defined in 31 CFR 1010.100(t) insofar as they
engage in CVC transactions that could be exposed to CVC mixing within
or involving a jurisdiction outside the United States.\150\ In light of
FinCEN's review of the anticipated differential effects on covered
financial institutions due to variations in both expected exposure and
preexisting monitoring and detection infrastructure, as well as
FinCEN's assessment of current market practices,\151\ FinCEN expects
that the largest portion of the novel costs incurred in complying with
the first special measure will be associated with indirect \152\
exposure to CVC mixing at financial institutions not currently
operating primarily in the provision of virtual asset services and
cases where the jurisdictions involved or under which CVC mixing occurs
are particularly difficult to ascertain. However, it is unclear whether
this proportion of expected novel compliance costs would itself be
large because it would be difficult to uniquely identify expenses
incurred distinctly as a function of special measure one compliance
from expenses incurred in the course of pre-existing BSA
requirements,\153\ as both would largely rely on use of the same
activities, technology, and services.
---------------------------------------------------------------------------
\150\ See discussion of covered financial transactions
(clarifying the definitional requirement that a reportable
transaction must occur in CVC) supra Section VI.A.4,
\151\ See discussion of anticipated differential effects supra
Section VIII.A.2(i)(A); see also discussion of current market
practices supra Section VIII.A.2(ii)(B).
\152\ Id. at note 122.
\153\ See discussion of existing BSA requirements regarding
identification and monitoring of financial transaction associations
with foreign jurisdictions and geographic locations supra Section
VI.A.5. See also discussion of FinCEN requirements under FATF
guidance supra Section VIII.A.2(ii)(A).
---------------------------------------------------------------------------
It is also unclear whether future relative distributions of direct
\154\ versus indirect \155\ exposure would continue in the same pattern
as historically observed, but at present do not have empirical evidence
that would suggest substantial changes are imminent. Detecting indirect
\156\ exposure may require certain financial institutions to newly
obtain commercial programs and/or services to facilitate compliance
with the rule as proposed as CVC mixing practices continue to evolve.
The cost of these services, based on current market prices, could run
in excess of tens of thousands of dollars per license and would require
analysts to remain continually engaged in blockchain tracing to stay up
to date with emerging trends in the rapidly developing digital asset
industry. It is unclear at this time whether financial institutions or
third party service providers would incur the majority of costs
associated with analytical updating as CVC mixing practices evolve, or
the extent to which these cost increases may be passed through to a
financial institution's customers. It is also unclear how these
compliance-related costs might scale with the proposed increased
reporting and recordkeeping requirements because it requires
speculation about how the potential for new entrants to the third party
mixing detection service market and/or technological advancements (that
would not occur but for the proposed compliance obligations making them
economically attractive investments) would affect costs.\157\
---------------------------------------------------------------------------
\154\ Id. at note 121.
\155\ Id. at note 122.
\156\ Id.
\157\ See discussion supra Section VIII.A.2(i)(D).
---------------------------------------------------------------------------
FinCEN acknowledges to that to the extent that a covered
transaction might require the filing of both a SAR and special measure
one related report, concurrent satisfaction of both sets of reporting
and recordkeeping requirements might result in some duplicative costs
related to any overlap.
[[Page 72719]]
To the extent that the forgoing analysis has failed to take into
consideration any material facts, data, circumstances, or other
considerations that, had they been considered, would have substantially
altered the balance of costs and benefits attendant to the proposed
special measure(s), FinCEN has invited public comment.\158\
---------------------------------------------------------------------------
\158\ See Sections VII.A. and VII.E.
---------------------------------------------------------------------------
5. Economic Consideration of Available Regulatory Alternatives
FinCEN has considered a number of alternative policies that could
have been proposed to accomplish the same objectives.\159\ These
policies included the selection of one, or a combination of, other
special measure(s) or, alternatively the selection of the same special
measure with a narrower scope.
---------------------------------------------------------------------------
\159\ See discussion supra Section V.E.
---------------------------------------------------------------------------
(i) Special Measure Two: Beneficial Ownership Information Requirements
Instead of recordkeeping and reporting requirements, FinCEN could
have pursued the application of special measure two, which would have
required domestic financial institutions and agencies to obtain and
retain the beneficial ownership information of any account at a
depository institution opened or maintained by a foreign person or
their representative that the institution or agency knows, suspects, or
has reason to suspect is involved in a CVC mixing transaction. While
this information about beneficial ownership related to CVC mixing
transaction participants could be similar to certain elements required
under the current proposal and hence of comparable value, the
alternative focus of special measure two on the ownership of accounts
instead of the nature of transactions is expected to impose similar
compliance costs with lower attendant benefits both in quantity of
useful information obtained and in scope of financial institutions to
whom the information-gathering requirements would apply. As such, the
imposition of special measure two instead of special measure one would
be strictly less efficient in addressing the class of transactions of
primary money laundering concern.
(ii) Special Measures Three Through Five
Alternatively, FinCEN could have proposed to impose special measure
three, four, five, or some combination thereof. Special measures three
and four would simply require domestic financial institutions and
agencies to obtain certain identifying information regarding the
customer or their representative as a condition to open or maintain a
payable-through \160\ or correspondent \161\ account, respectively, if
the financial institution or agency knows, suspects, or has reason to
suspect the account and transactions conducted through it involve CVC
mixing. More severely, special measure five could have imposed
prohibitions or conditions \162\ on the opening or maintenance of a
correspondent or payable-through account if the domestic covered
financial institution or agency knows, suspects, or has reason to
suspect that transactions conducted through the account involve CVC
mixing.
---------------------------------------------------------------------------
\160\ 31 U.S.C. 5318A(b)(3)
\161\ 31 U.S.C. 5318A(b)(4)
\162\ 31 U.S.C. 5318(b)(5)
---------------------------------------------------------------------------
Because the expected results of imposing special measures three,
four, or both, absent special measure five would likely be similar to
expectations with respect to special measure two, that analysis is not
repeated here. Instead, an approach that would impose special measures
three or four, or both, in conjunction with special measure five is
considered. As discussed above,\163\ FinCEN determined that these
special measures are less relevant in the context of CVC transactions,
including those that involve CVC mixing, as CVC transactions are
conducted outside of the traditional banking system. Therefore,
expected benefits would also be lower than under proposed special
measure one requirements due to the limited intersection between
transactions in CVC and the foreign use of domestic traditional bank
accounts. Given these considerations, this alternative approach was
rejected.
---------------------------------------------------------------------------
\163\ See Section V.E.
---------------------------------------------------------------------------
(iii) Alternate Specification of Special Measure One: Specified Terror
Finance-Related Actors and Transactions Only
Finally, FinCEN considered an alternative that would employ the
same special measure but with greater specificity of covered
transactions that would limit the scope of interest in CVC mixing-
exposed transactions to only those identifiably sponsored by or
affiliated with terror finance by Hamas, ISIS, or the DPRK. This
alternative is expected to incur higher costs related to, among other
things, the additional burden a financial institution would have in
making a determination about a transaction's connection to an
identifiable source or affiliate of the applicable terrorist
organization. It would also limit the potential informational benefits
of the measure by discarding similar reports and records that may be of
equal or greater value to investigating, prosecuting, or
disincentivizing CVC mixing supported illicit activities but lack an
identifiable connection to Hamas, ISIS, or the DPRK. Because of these
dual inefficiencies, special measure one as proposed is considered to
strike a more appriopriate balance.
B. Executive Orders
Executive Orders 12866, 13563, and 14094 direct agencies to assess
costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). Executive
Order 13563 emphasizes the importance of quantifying both costs and
benefits, of reducing costs, of harmonizing rules, and of promoting
flexibility.
It has been determined that this proposed rule is not a significant
regulatory action under section 3(f) of Executive Order 12866, as
amended. However, in light of the nature of this proposed rule, FinCEN
has prepared an economic analysis to help inform its consideration of
the impacts of the proposed rule.
C. Regulatory Flexibility Act
When an agency issues a rulemaking proposal, the Regulatory
Flexibility Act (RFA) requires the agency to ``prepare and make
available for public comment an initial regulatory flexibility
analysis''(IRFA) that will ``describe the impact of the proposed rule
on small entities.'' \164\ However, Section 605 of the RFA allows an
agency to certify a rule, in lieu of preparing an analysis, if the
proposed rulemaking is not expected to have a significant economic
impact on a substantial number of small entities.
---------------------------------------------------------------------------
\164\ 5 U.S.C. 603(a).
---------------------------------------------------------------------------
1. Estimate of the Number of Small Entities to Whom the Proposed Rule
Will Apply
The reporting and recordkeeping requirements proposed under the
first special measure requires certain covered financial institutions
to report to FinCEN information associated with transactions or
attempted transactions involving CVC mixing and maintain certain
related records for a fixed period of time.\165\ Table 2 (below)
presents FinCEN estimates of the number of affected institutions that
may be deemed
[[Page 72720]]
small entities. To identify whether a financial institution is small,
FinCEN generally uses the Small Business Administration's (SBA) latest
annual size standards for small entities in a given industry, unless
otherwise noted.\166\ FinCEN also uses the U.S. Census Bureau's
publicly available 2017 Statistics of U.S. Businesses survey data
(Census survey data).\167\ FinCEN applies SBA size standards to the
corresponding industry's receipts in the 2017 Census survey data and
determines what proportion of a given industry is deemed small, on
average. FinCEN considers a financial institution to be small if it has
total annual receipts less than the annual SBA small entity size
standard for the financial institution's industry. FinCEN applies these
estimated proportions to FinCEN's current financial institution counts
for brokers/dealers in securities, money services businesses, casinos,
card clubs, futures commission merchants, introducing brokers in
commodities, and mutual funds to determine the proportion of current
small financial institutions in those industries. Numbers have been
rounded as in Section VIII.A.2(i)(A) to facilitate aggregation.
---------------------------------------------------------------------------
\165\ See discussion supra Section VIII.A.2-3.
\166\ See U.S. Small Business Administration's Table of Size
Standards, available at https://www.sba.gov/sites/sbagov/files/2023-06/Table%20of%20Size%20Standards_Effective%20March%2017%2C%202023%20%282%29.pdf.
\167\ See U.S. Census Bureau, U.S. & states, NAICS, detailed
employment sizes (U.S., 6-digit and states, NAICS sectors) (2017),
available at https://www.census.gov/data/tables/2017/econ/susb/2017-susb-annual.html. The Census survey documents the number of firms
and establishments, employment numbers, and annual payroll by State,
industry, and enterprise every year. Receipts data, which FinCEN
uses as a proxy for revenues, is available only once every five
years, with 2017 being the most recent survey year with receipt
data.
Table 2--Estimates of Small Affected Financial Institutions by Type
------------------------------------------------------------------------
Number of
Financial institution type \a\ entities
------------------------------------------------------------------------
Bank \b\.............................................. \c\ 7,970
Broker/Dealer in Securities \d\....................... \e\ 3,450
Money Services Businesses \f\......................... \g\ 24,010
Telegraph Company \h\................................. \i\ 0
Casino \j\............................................ \k\ 930
Card Club \l\......................................... \m\ 250
Person subject to supervision by any State or Federal \o\ N/A
Bank Supervisory Authority \n\.......................
Futures Commission Merchant \p\....................... \q\ 56
Introducing Broker in Commodities \r\................. \s\ 900
Mutual Fund \t\....................................... \u\ 1,380
------------------------------------------------------------------------
\a\ As typographically grouped in 31 CFR 1010.100(t).
\b\ See 31 CFR 1010.100(t)(1); see also 31 CFR 1010.100(d). The SBA
currently defines small entity size standards for banks as follows:
less than $850 million in total assets for commercial banks, savings
institutions, and credit unions.
\c\ Counts of certain types of banks, savings associations, thrifts,
trust companies are from Q1 2023 Federal Financial Institutions
Examination Council (FFIEC) Call Report data, available a https://cdr.ffiec.gov/public/pws/downloadbulkdata.aspx. Data for institutions
that are not insured, are insured under non-FDIC deposit insurance
regimes, or do not have a Federal functional regulator are from the
FDIC's Research Information System, available at https://www.fdic.gov/foia/ris/index.html. Credit union data are from the NCUA for Q1 2023,
available at https://www.ncua.gov/analysis/credit-union-corporate-call-report-data. Because data accessed through FFIEC and NCUA Call Report
data provides information about asset size for banks, trusts, savings
and loans, credit unions, etc., FinCEN is able to directly determine
how many banks and credit unions are small by SBA size standards.
Because the Call Report data does not include institutions that are
not insured, are insured under non-FDIC deposit insurance regimes, or
that do not have a Federal financial regulator, FinCEN assumes that
all such entities listed in the FDIC's Research Information System
data are small, unless they are controlled by a holding company that
does not meet the SBA's definition of a small entity, and includes
them in the count of small banks. Consistent with the SBA's General
Principles of Affiliation, 13 CFR 121.103(a), FinCEN aggregates the
assets of affiliated financial institutions using FFIEC financial data
reported by bank holding companies on forms Y-9C, Y-9LP, and Y-9SP,
available at https://www.ffiec.gov/npw/FinancialReport/FinancialDataDownload FinancialDataDownload, and ownership data, available at https://www.ffiec.gov/npw/FinancialReport/DataDownload, when determining if an
institution should be classified as small. FinCEN uses four quarters
of data reported by holding companies, banks, and credit unions
because a ``financial institution's assets are determined by averaging
the assets reported on its four quarterly financial statements for the
preceding year.'' See U.S. Small Business Administration's Table of
Size Standards, p. 38 n.8, https://www.sba.gov/sites/sbagov/files/2023-06/Table%20of%20Size%20Standards_Effective%20March%2017%2C%202023%20%282%29.pdf. FinCEN recognizes that using SBA size standards to identify
small credit unions differs from the size standards applied by the
NCUA. However, for consistency in this analysis, FinCEN applies the
SBA-defined size standards.
\d\ 31 CFR 1010.100(t)(2).
\e\ The SBA currently defines small entity size standards for investment
banking and securities intermediation as less than $47 million in
average annual receipts. See paragraph preceding table for details of
analysis.
\f\ 31 CFR 1010.100(t)(3).
\g\ The SBA currently defines small entity size standards for financial
transactions processing, reserve, and clearinghouse activities as less
than $47 million in average annual receipts. See paragraph preceding
table for details of analysis.
\h\ 31 CFR 1010.100(t)(4).
\i\ As an estimate of uniquely registered, potentially affected small
entities, FinCEN expect this category to contain no additional persons
or organizations not already included in other counts, particularly as
money transmitters.
\j\ 31 CFR 1010.100(t)(5)(i)-(iii).
\k\ The SBA currently defines small entity size standards for casinos as
less than $34 million in average annual receipts. See paragraph
preceding table for details of analysis.
\l\ 31 CFR 1010.100(t)(6)(i)-(ii).
\m\ The SBA currently defines small entity size standards for other
gambling industries as less than $40 million in average annual
receipts. See paragraph preceding table for details of analysis.
\n\ 31 CFR 1010.100(t)(7).
\o\ It is unclear to FinCEN at this time whether any entities exist in
this category that for purposes of being counted towards unique
affected parties incurring burdens associated with the rule, if
adopted as proposed, are not already captured by concurrent status in
another category of financial institution under the 31 CFR 1010.100(t)
definition. To the extent that additional data can better inform this
estimate, public comment is invited.
\p\ 31 CFR 1010.100(t)(8).
\q\ The SBA currently defines small entity size standards for commodity
contracts intermediation as less than $47 million in average annual
receipts. See paragraph preceding table for details of analysis.
\r\ 31 CFR 1010.100(t)(9).
\s\ Supra note q.
[[Page 72721]]
\t\ 31 CFR 1010.100(t)(10).
\u\ The SBA currently defines small entity size standards for open-end
investment funds as less than $40 million in average annual receipts.
See paragraph preceding table for details of analysis.
2. Expectation of Impact
For the reasons discussed above in Section VIII.A, FinCEN does not
expect all potentially affected financial institutions to be equally
affected by the proposed rule.\168\ These expectations of differential
effects are of first-order relevance because, for the purposes of the
IRFA, a rulemaking must be jointly impactful in both its breadth
(substantial number) and depth (significant economic impact) on small
entities to require additional, tailored analysis. FinCEN's categorical
analysis of the financial institutions defined in 31 CFR 1010.100(t)
does not support the need for an initial regulatory flexibility
analysis because it determined that, in cases where a substantial
number of financial institutions are small entities, the economic
impact of the rule is not expected to be significant. Conversely, in
cases where the economic impact is expected to be its most significant,
it is not clear that a substantial number of affected institutions
would meet the criteria to qualify as small entities.
---------------------------------------------------------------------------
\168\ See discussion supra Section VIII.A.2(i)(A).
---------------------------------------------------------------------------
To the extent that other small entities that are not financial
institutions may be economically affected by the proposed
rulemaking,\169\ FinCEN did not include any estimates of affected
parties or calculations of effects in this IRFA because those effects,
for most non-financial institutions, are primarily expected to be
benefits in the form of potential increases in demands for services. An
attempt to quantify increased operating costs accompanying these
increases in demand generally, and for small entities specifically,
would be so speculative as to be uninformative. In the event that a
more precise forecast could be reliably formed with available data and
would alter the conclusions of this analysis, FinCEN is requesting
information from the public.
---------------------------------------------------------------------------
\169\ See, e.g., discussion supra Section VIII.A.2(i)(D).
---------------------------------------------------------------------------
3. Certification
When viewed as a whole, FinCEN does not anticipate that the
proposals contained in this rulemaking will have a significant impact
on a substantial number of small financial institutions or other
potentially affected businesses. Accordingly, FinCEN certifies that
this rule will not have a significant economic impact on a substantial
number of small entities. FinCEN invites comments from members of the
public who believe there will be a significant economic impact on small
entities from the imposition of the first special measure regarding CVC
mixers.\170\
---------------------------------------------------------------------------
\170\ See Section VII.E.
---------------------------------------------------------------------------
D. Unfunded Mandates Reform Act
Section 202 of the Unfunded Mandates Reform Act of 1995 \171\
(Unfunded Mandates Reform Act), requires that an agency prepare a
budgetary impact statement before promulgating a rule that may result
in expenditure by the state, local, and tribal governments, in the
aggregate, or by the private sector, of $100 million or more in any one
year, adjusted for inflation.\172\ If a budgetary impact statement is
required, section 202 of the Unfunded Mandates Reform Act also requires
an agency to identify and consider a reasonable number of regulatory
alternatives before promulgating a rule.\173\
---------------------------------------------------------------------------
\171\ Public Law 104-4 (March 22, 1995).
\172\ Id.
\173\ Id.
---------------------------------------------------------------------------
As discussed in the foregoing analysis,\174\ it is unclear if
either the gross or net cost of compliance to the private sector would
exceed $177 million annually.\175\ In the event that this is so, FinCEN
has performed the preliminary analysis above to address the potential
need to satisfy the requirements of the Unfunded Mandates Reform
Act.\176\ FinCEN is additionally soliciting comments--preferably
including data, studies, or other forms of quantitative analysis--that
would specifically inform our quantification of expected compliance
related expenditures by state, local, and tribal governments and/or the
private sector in the event that such costs would, in light of more
complete information, be demonstrably expected to exceed the annual
$100 million threshold, adjusted for inflation ($177 million).
---------------------------------------------------------------------------
\174\ See Section VIII.A.4.
\175\ The Unfunded Mandates Reform Act requires an assessment of
mandates that will result in an annual expenditure of $100 million
or more, adjusted for inflation. The U.S. Bureau of Economic
Analysis reports the annual value of the gross domestic product
(GDP) deflator in 1995, the year of the Unfunded Mandates Reform
Act, as 71.823, and as 127.224 in 2022. See U.S. Bureau of Economic
Analysis, ``Table 1.1.9. Implicit Price Deflators for Gross Domestic
Product'' (accessed Friday, June 2, 2023) available at https://apps.bea.gov/iTable/?reqid=19&step=3&isuri=1&1921=survey&1903=13t.
Thus, the inflation adjusted estimate for $100 million is 127.224/
71.823 x 100 = $177 million.
\176\ See generally, discussion supra Section VIII.A; see
specifically, discussion of alternatives considered supra Section
V.E. and Section VIII.A.5.
---------------------------------------------------------------------------
E. Paperwork Reduction Act
The recordkeeping and reporting requirements contained in this
proposed rule will be submitted by FinCEN to the Office of Management
and Budget for review in accordance with the Paperwork Reduction Act of
1995 \177\ (PRA). Under the PRA, an agency may not conduct or sponsor,
and a person is not required to respond to, a collection of information
unless it displays a valid control number assigned by OMB. Written
comments and recommendations for the proposed information collection
can be submitted by visiting www.reginfo.gov/public/do/PRAMain. Find
this particular document by selecting ``Currently under Review--Open
for Public Comments'' or by using the search function. Comments are
welcome and must be received by [90 DAYS AFTER DATE OF PUBLICATION IN
THE FEDERAL REGISTER]. In accordance with requirements of the PRA and
its implementing regulations, 5 CFR part 1320, the following
information concerning the collection of information as required by 31
CFR 1010.662 is presented to assist those persons wishing to comment on
the information collections.
---------------------------------------------------------------------------
\177\ 44 U.S.C. 3507(d).
---------------------------------------------------------------------------
The provisions in this proposed rule pertaining to the collection
of information can be found in section 1010.662(b)(1). The information
required to be reported in section 1010.662(b)(1) will be used by the
U.S. Government to monitor the class of transactions of primary money
laundering concern. The information required to be maintained by
section 1010.662(b)(3) will be used by federal agencies and certain
self-regulatory organizations to verify compliance by covered financial
institutions with the provisions of 31 CFR 1010.662. The class of
financial transactions affected by the reporting requirement is
identical to the class of financial transactions affected by the
recordkeeping requirement. The collection of information is mandatory.
Frequency: Covered financial institutions would be required to file
within 30 days of detecting a covered transaction.\178\ As nothing
prevents a covered financial institution from optimizing with respect
to scale by
[[Page 72722]]
filing later, while still within the 30-day limit, it is foreseeable
that despite a distinct filing obligation per covered transaction, some
entities may elect to file all required reports still within the same
30-day window at a single time, effectively reducing the frequency of
filing.
---------------------------------------------------------------------------
\178\ 31 CFR 1010.662(b)(2).
---------------------------------------------------------------------------
Description of Affected Financial Institutions: Only those covered
financial institutions defined in section 1010.662(a)(4) with
engagement in the covered financial transactions as defined in section
1010.662(a)(5) would be affected.
Estimated Number of Affected Financial Institutions: Approximately
15,000.\179\
---------------------------------------------------------------------------
\179\ This estimate is informed by public and non-public data
sources regarding both an expected maximum number of entities that
may be affected and the number of active, or currently reporting,
registered financial institutions and takes into consideration the
possibility of voluntary reporting by certain parties without an
express obligation to file reports. See Section VIII.A.2(i)(A).
---------------------------------------------------------------------------
Estimated Average Annual Burden in Hours per Affected Financial
Institution: 98.\180\
---------------------------------------------------------------------------
\180\ Assumes, on average, one full work-day per 30-day period
is required to complete reporting and recordkeeping related tasks.
Due to the anticipated skew in expected annual burden hours, this
average is unlikely to represent a meaningful approximation for most
covered financial institutions.
---------------------------------------------------------------------------
Estimated Total Annual Burden: 1,470,000 hours.
FinCEN specifically invites comments on: (a) whether the proposed
collection of information is necessary for the proper performance of
the mission of FinCEN, including whether the information would have
practical utility; (b) the accuracy of FinCEN's estimate of the burden
of the proposed collection of information; (c) ways to enhance the
quality, utility, and clarity of the information required to be
maintained; (d) ways to minimize the burden of the required collection
of information, including through the use of automated collection
techniques or other forms of information technology; (e) estimates of
capital or start-up costs and costs of operation, maintenance, and
purchase of services to report the information.
IX. Regulatory Text
List of Subjects in 31 CFR Part 1010
Administrative practice and procedure, Banks, Banking, Brokers,
Crime, Foreign banking, Terrorism.
Authority and Issuance
For the reasons set forth in the preamble, FinCEN proposes amending
31 CFR part 1010 as follows:
PART 1010--GENERAL PROVISIONS
0
1. The authority citation for part 1010 continues to read as follows:
Authority: 12 U.S.C. 1829b and 1951-1959; 31 U.S.C.5311-5314,
5316-5336; title III, sec. 314, Pub. L. 107-56, 115 Stat. 307; sec.
2006, Pub. L. 114-41, 129 Stat. 458-459; sec. 701 Pub. L. 114-74,
129 Stat. 599; sec. 6403, Pub. L. 116-283, 134 Stat. 3388.
0
2. Add Sec. 1010.662 to read as follows:
Sec. 1010.662 Special measures regarding CVC mixing transactions.
(a) Definitions. For purposes of this section, the following terms
have the following meanings.
(1) Convertible Virtual Currency (CVC). The term ``convertible
virtual currency (CVC)'' means a medium of exchange that either has an
equivalent value as currency, or acts as a substitute for currency, but
lacks legal tender status. Although Bitcoin has legal tender status in
at least two jurisdictions, the term CVC includes Bitcoin for the
purpose of this section.
(2) CVC Mixer. The term ``CVC mixer'' means any person, group,
service, code, tool, or function that facilitates CVC mixing.
(3) CVC mixing. (i) The term ``CVC mixing'' means the facilitation
of CVC transactions in a manner that obfuscates the source,
destination, or amount involved in one or more transactions, regardless
of the type of protocol or service used, such as:
(A) Pooling or aggregating CVC from multiple persons, wallets,
addresses, or accounts;
(B) Using programmatic or algorithmic code to coordinate, manage,
or manipulate the structure of a transaction;
(C) Splitting CVC for transmittal and transmitting the CVC through
a series of independent transactions;
(D) Creating and using single-use wallets, addresses, or accounts,
and sending CVC through such wallets, addresses, or accounts through a
series of independent transactions;
(E) Exchanging between types of CVC or other digital assets; or
(F) Facilitating user-initiated delays in transactional activity.
(ii) Exception. Notwithstanding paragraph (a)(3)(i) of this
section, CVC mixing does not include the use of internal protocols or
processes to execute transactions by banks, broker-dealers, or money
services businesses, including virtual asset service providers that
would otherwise constitute CVC mixing, provided that these financial
institutions preserve records of the source and destination of CVC
transactions when using such internal protocols and processes; and
provide such records to regulators and law enforcement, where required
by law.
(4) Covered financial institution. The term ``covered financial
institution'' has the same meaning as ``financial institution'' in 31
CFR 1010.100(t).
(5) Covered transaction. The term ``covered transaction'' means a
transaction as defined in 31 CFR 1010.100(bbb)(1) in CVC by, through,
or to the covered financial institution that the covered financial
institution knows, suspects, or has reason to suspect involves CVC
mixing within or involving a jurisdiction outside the United
States.\181\
---------------------------------------------------------------------------
\181\ This requirement would be independent of any recordkeeping
requirement pursuant to 31 CFR 1010.410.
---------------------------------------------------------------------------
(b) Reporting and recordkeeping requirements. Covered financial
institutions are required to report information in accordance with
paragraph (b)(1) of ths section and maintain records demonstrating
compliance in accordance with paragraph (b)(3) of this section.
(1) Reporting--(i) Reportable information regarding the covered
transaction. The covered financial institution shall provide the
following reportable information in its possession, with respect to
each covered transaction, within 30 calendar days of initial detection
of a covered transaction:
(A) The amount of any CVC transferred, in both CVC and its U.S.
dollar equivalent when the transaction was initiated;
(B) The CVC type;
(C) The CVC mixer used, if known;
(D) CVC wallet address associated with the mixer;
(E) CVC wallet address associated with the customer;
(F) Transaction hash;
(G Date of transaction;
(H) The IP addresses and time stamps associated with the covered
transaction; and
(I) Narrative
(ii) Reportable information regarding the customer associated with
the covered transaction. The covered financial institution shall
provide the following reportable information in its possession,
regarding the customer associated with each covered transaction:
(A) Customer's full name;
(B) Customer's date of birth;
(C) Customer's address;
(D) Email address associated with any and all accounts from which
or to which the CVC was transferred;
[[Page 72723]]
(E) Phone number associated with any and all accounts from which or
to which the CVC was transferred;
(F) Internal Revenue Service or foreign tax identification number,
or if none are available, a non-expired United States or foreign
passport number or other government-issued photo identification number,
such as a driver's license; and
(2) Filing procedures. The reports required under paragraph (b)(1)
of this section shall be filed with FinCEN 30 calendar days from the
date of detection in the manner that FinCEN prescribes.
(3) Recordkeeping. A covered financial institution is required to
document its compliance with the requirements of this section.
Dated: October 19, 2023.
Andrea M. Gacki,
Director, Financial Crimes Enforcement Network.
[FR Doc. 2023-23449 Filed 10-20-23; 8:45 a.m.]
BILLING CODE 4810-02-P